acciente / oacc-core

OACC (Object ACcess Control) is an advanced Java Application Security Framework
http://oaccframework.org/
Apache License 2.0
107 stars 23 forks source link

Upgrading or revoking certain custom permissions fails when permission name exists for multiple resource classes #48

Closed fspinnenhirn closed 5 years ago

fspinnenhirn commented 5 years ago

Upgrading or revoking custom resource permissions, resource create-permissions and global resource permissions fails when another custom permission of the same name exists for another resource class. This bug occurs because the correlated subqueries to look up a custom permission by name are not correctly referencing their outer table in some instances.

This affects:

Note that this does not affect system permissions and occurs regardless of recursive or non-recursive SQL profiles.