[
https://jira.duraspace.org/browse/DS-562?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Bollini updated DS-562:
------------------------------
Attachment: ds-562-delegate-admin-remove-templateitem.patch
Summary: Community admin or user with WRITE, ADD and ADMIN policy on
collection cannot delete that collection due to bug in
AuthorizeUtil.authorizeManageTemplateItem(context,collection) (was: User with
WRITE, ADD and ADMIN policy on collection cannot delete that collection due to
bug in AuthorizeUtil.authorizeManageTemplateItem(context,collection))
> Community admin or user with WRITE, ADD and ADMIN policy on collection cannot
> delete that collection due to bug in
> AuthorizeUtil.authorizeManageTemplateItem(context,collection)
> --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DS-562
> URL: https://jira.duraspace.org/browse/DS-562
> Project: DSpace
> Issue Type: Bug
> Components: DSpace API
> Affects Versions: 1.6.0
> Reporter: Andrew Taylor
> Assignee: Andrea Bollini
> Fix For: 1.7.0
>
> Attachments: ds-562-delegate-admin-remove-templateitem.patch
>
>
> During the process of deleting a collection a call is made to
> AuthorizeUtil.authorizeManageTemplateItem(context,collection) - line 289 of
> 1.6.0 code, which seems to contain a logic error in the way it checks the
> permissions.
> As it currently stands this method will only 'allow' if the user is a system
> admin or is an admin who cannot edit the collection (ie lacks the ADD or
> WRITE policy).
> This to me seems like it is broken but I will happily stand corrected if it
> is working as intended.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.duraspace.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
http://p.sf.net/sfu/nokia-dev2dev
_______________________________________________
Dspace-devel mailing list
Dspace-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-devel
