arturobernalg commented on PR #484:
URL: https://github.com/apache/jspwiki/pull/484#issuecomment-6668121490
I tested this pull request merged into master 3a41a6de6 (head 7792b695e).
The ACL tests pass (48 tests), but none of them mixes simple and advanced rules
in one page. On a running wiki (war in Tomcat 10.1 in Docker, with an anonymous
browser, and master as the control) I found three problems.
1. A page with only [{ALLOW edit Admin OR Editors}] can be viewed by an
anonymous user, who sees its text. On master, and with a simple rule such as
[{ALLOW edit Admin}], the anonymous user is sent to the login page, so
restricting edit also restricts view. In DefaultAuthorizationManager the
advanced branch returns true when the page has no rule for the permission that
is asked (the node is null), where the simple ACL denies it.
2. A simple rule followed by an advanced one loses the simple one. With
[{ALLOW view Authenticated}] and then [{ALLOW edit Admin OR Editors}], the
anonymous user is not sent to the login page. In DefaultAclManager.parseAcl a
new AdvancedAcl replaces the Acl that the page already has. The body of that
page came out empty in my run, which I did not explain.
3. An advanced rule followed by a simple one fails when the page is saved:
the error page of JSPWiki shows "Not supported yet.". It is the
UnsupportedOperationException of AdvancedAcl.getAclEntry, which parseAcl calls
for the simple rule.
From reading the code, not tested: a line is read as advanced when it
contains " AND ", " OR " or " NOT ", so an existing rule with a user or group
name that has one of those words would change how it is read. I did not test
the NOT operator beyond the existing tests, nor real groups or roles.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
