Bug 44120 - Creating sibling doesn't take AC into account
Summary: Creating sibling doesn't take AC into account
Status: NEW
Alias: None
Product: Lenya
Classification: Unclassified
Component: Access Control (show other bugs)
Version: Trunk
Hardware: Other other
: P2 normal
Target Milestone: 2.0.1
Assignee: Lenya Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-12-21 08:47 UTC by Richard Frovarp
Modified: 2009-01-22 04:17 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Frovarp 2007-12-21 08:47:55 UTC
If a user has permissions on a node to create pages (edit), they can create a
new page as a sibling of that node, even if they don't have proper permissions
on the parent. The page is then created as a sibling, and they don't have any
permissions to the page. Since this can be seen as a way around the permission
tree, they shouldn't be given permission to do so. When the sibling option is
chosen, the permission check should be done against the parent.
Comment 1 Andreas Hartmann 2008-02-22 06:38:10 UTC
This bug is based on a fundamental flaw of our access control strategy. We only
care for protecting usecases on pages, but there's no protection of the
repository itself. 
Comment 2 Richard Frovarp 2008-02-22 07:07:09 UTC
I was wondering if we could just run the check that would initially prevent
access to the usecase again but with the right parent in the tree. However, I
haven't had a chance to investigate how this would be done exactly.
Comment 3 Andreas Hartmann 2009-01-22 04:17:41 UTC
An easy workaround would be this:

Instead of the radio buttons to choose between "create child" and "create sibling", we could use a button "create sibling" which calls the "create child" usecase on the parent URL.