[
https://issues.apache.org/jira/browse/JSPWIKI-281?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18133429#comment-18133429
]
Arturo Bernal commented on JSPWIKI-281:
---------------------------------------
Checked against current master. The page name suggestions in the editor call
the AJAX search service, which is registered with the default permission
PagePermission VIEW, that is a view permission over all pages. The dispatcher
checks it before it runs the service and answers Denied when it is missing; the
message in this report came from the old JSONRPCManager, which no longer
exists. I tested it with PagePermission.implies: a grant of modify and rename
limited to pages starting with PO does not imply view over all pages (false),
while a grant of rename over all pages does (true), and so does view over all
pages (true). That matches the workaround in the report. So this is how the
check is written and not a regression: a policy that takes view over all pages
away from a user breaks the page name suggestions of that user. Whether the
service should instead check the permission for each page it returns is a
design decision, so I leave the ticket open.
> Unexpected permission required for editing page references
> ----------------------------------------------------------
>
> Key: JSPWIKI-281
> URL: https://issues.apache.org/jira/browse/JSPWIKI-281
> Project: JSPWiki
> Issue Type: Bug
> Components: Authentication & Authorization
> Affects Versions: 2.6.3
> Environment: Linux, tomcat 5.5
> Reporter: Ulrich Gemkow
> Assignee: Andrew R. Jaquith
> Priority: Minor
>
> I tried to restrict authenticated users ability to create and modifiy pages
> to pages with names starting with selected letters (i.e. PO*).
> I used the following settings in the policy file
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:PO*",
> "modify,rename";
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:IF*",
> "modify,rename";
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:IO*",
> "modify,rename";
> permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*",
> "createPages";
> However this did not work . Whenever a used wanted to add a reference to
> another page in a page he edited (typing "[a" for
> example), he got the error poopup "No permission to access this AJAX
> method!". The message results from the
> JSONRPCManager which tried to display related page names.
> I had to add
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
> "rename";
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
> "rename";
> permission com.ecyrd.jspwiki.auth.permissions.PagePermission "*:*",
> "rename";
> to the policy (trial and error, I did not really understood where the problem
> comes from) to make this message
> disappear.
> This behaviour is at least unexpected. I cannot judge whether it is a bug.
> Thanks for listening and the great work!
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
