[MAGNOLIA-5537] DefaultACLBasedPermissions do not account for JCR's reordering permission Created: 10/Dec/13  Updated: 11/Dec/13  Resolved: 10/Dec/13

Status: Closed
Project: Magnolia
Component/s: core, security
Affects Version/s: 5.2
Fix Version/s: 5.2.1

Type: Bug Priority: Critical
Reporter: Mikaël Geljić Assignee: Mikaël Geljić
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
causality
is causing MGNLUI-2510 UI shouldn't enable actions for which... Closed
Template:
Acceptance criteria:
Empty
Task DoD:
[ ]* Doc/release notes changes? Comment present?
[ ]* Downstream builds green?
[ ]* Solution information and context easily available?
[ ]* Tests
[ ]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
Bug DoR:
[ ]* Steps to reproduce, expected, and actual results filled
[ ]* Affected version filled

 Description   

As diagnosed in MGNLUI-2510:

When setting a subtree in pages to read-only, one can still reorder nodes relatively to its siblings.

Turns out ordering logic in JCR is relying on the Permission.MODIFY_CHILD_NODE_COLLECTION JCR permission, which is currently not mapped to our Permissions in the DefaultACLBasedPermissions class.


Generated at Mon Feb 12 04:06:05 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.