Uploaded image for project: 'Magnolia'
  1. Magnolia
  2. MAGNOLIA-4569

MgnlUser.hasRole is broken (more precisely RepositoryBackedSecurityManager.hasAny)

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Neutral Neutral
    • 4.5.5
    • 4.5.4
    • security
    • None
    • osx-10.8.2 tomcat-7.0.29

      MgnlUser.hasRole does never return true. A quick way to reproduce it is via groovy console on a fresh 4.5.4 install:

      mgnl> user=ctx.getUser()
      ===> 
      MgnlUser - superuser [51ae3379-67cf-4994-9e05-f97cb8bc3e4a]
      mgnl> user.getAllRoles()
      ===> 
      [superuser]
      mgnl> user.hasRole("superuser")
      ===> 
      false
      mgnl>
      

      Debugging shows that it fails at:

      2012-10-06 13:31:34,067 DEBUG nolia.cms.security.RepositoryBackedSecurityManager: property /admin/superuser/roles/jcr:mixinTypes is a multi-valued property, so it's values can only be retrieved as an array
      javax.jcr.ValueFormatException: property /admin/superuser/roles/jcr:mixinTypes is a multi-valued property, so it's values can only be retrieved as an array
      	at org.apache.jackrabbit.core.PropertyImpl.internalGetValue(PropertyImpl.java:483)
      	at org.apache.jackrabbit.core.PropertyImpl.getValue(PropertyImpl.java:510)
      	at org.apache.jackrabbit.core.PropertyImpl.getString(PropertyImpl.java:520)
      	at info.magnolia.cms.security.RepositoryBackedSecurityManager$1.exec(RepositoryBackedSecurityManager.java:106)
      	at info.magnolia.cms.security.RepositoryBackedSecurityManager$1.exec(RepositoryBackedSecurityManager.java:90)
      	at info.magnolia.cms.security.JCRSessionOp.exec(JCRSessionOp.java:69)
      	at info.magnolia.context.MgnlContext.doInSystemContext(MgnlContext.java:403)
      	at info.magnolia.context.MgnlContext.doInSystemContext(MgnlContext.java:376)
      	at info.magnolia.cms.security.RepositoryBackedSecurityManager.hasAny(RepositoryBackedSecurityManager.java:90)
      	at info.magnolia.cms.security.MgnlUser.hasRole(MgnlUser.java:168)
      

      A workaround is:

      user.getAllRoles().contains("superuser")
      

        Acceptance criteria

              had Jan Haderka
              jpetersen Jonas Petersen [X] (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved:

                  Bug DoR
                  Task DoD