Server returns error with link to object in non-browsable folder - Githubissues

dewarim / cinnamon

Cinnamon CMS Server

Other

13 stars 7 forks source link

Server returns error with link to object in non-browsable folder #164

Closed boris-horner closed 6 years ago

boris-horner commented 6 years ago

The following scenario leads to a reproducable error:

one folder "perm"
one folder "noperm"
perm has an ACL that gives user test all permissions
noperm has an ACL that gives user test no permissions, not even browse
perm contains an object "permobject"
noperm contains an object "nopermobject".
nopermobject is linked into folder perm.

If user test lists the contents of perm (for example, by selecting the folder in the tree of Desktop Client):

If permobject has an ACL giving no browse permission to test, the system behaves correctly (it shows permobject, but not nopermobject).
If permobject has an ACL that gives browse permission to test, the system tries to retrieve the object, but since the parent folder has no browse permission, it can't retrieve it. But instead of simply not returning it, the getsubfolders command fails with message error.missing.permission._browse_folder.