setResourcePermissions() fails in the presence of inherited permissions and requires more grantor privileges than necessary

acciente / oacc-core

OACC (Object ACcess Control) is an advanced Java Application Security Framework

http://oaccframework.org/

Apache License 2.0

107 stars 23 forks source link

Closed fspinnenhirn closed 9 years ago

fspinnenhirn commented 9 years ago

The setResourcePermissions() method

incorrectly takes into account indirect (i.e. inherited and global) permissions the accessor has on the accessed resource, which would not even get affected
should only require the grantor to have grant-privileges on the direct permissions that were requested or would get removed, and not require granting rights to any indirect permissions