[NXP-15563] Update default permissions to handle removal of deny rights - Nuxeo Issue Tracker

XML

Word

Printable

Tags:
- bugday
- nxRepoTeam
- rights
- security
Impact type:

Data Persistence Change
Upgrade notes:

Hide

Permission CanAskForPublishing is no more included in Read.

For existing repositories, CanAskForPublishing has to be assigned explicitly on the Sections root.

Show
Permission CanAskForPublishing is no more included in Read. For existing repositories, CanAskForPublishing has to be assigned explicitly on the Sections root.
Sprint:
Sprint RepoTeam 5.9.5-2

The current permissions:

This is a problem if rights cannot be denied, as this is not possible anymore (without configuration) to:

deny the CanAskForPublishing right on the SectionRoot (usually to deny it for the members group)
deny the Remove right to someone having access to a Workspace.

Possible solution:

Create WriteWithoutRemove and ReadWithoutPublishing rights -> does not break compatibility, handles the removal of denied rights properly.

is required by

NXP-15834 Denying "Can ask for publish" permission has no effect