Listing the content of a section fails with CMIS API if at least one of its child (proxy) targets a live document which is checked out.
Steps to reproduce
- Add the following line in nuxeo.conf to enable proxy usage in CMIS
org.nuxeo.cmis.proxies=true - As an administrator, create a user named cmis-user
- Grant Read permission to cmis-user on the root of the repository
- Deny Read permission to cmis-user on the root of the workspaces, or block the right inheritance
- Create a section under the root of sections
- Create a document, publish it to the newly created section and modify the document to be in version 0.1+
- As cmis-user, open CMIS Workbench and connect with cmis-user credentials to http://localhost:8080/nuxeo/json/cmis (Browser binding)
- Browse the repository to the previously created section
An error is displayed, saying that Read permission is denied.
The corresponding stacktrace is
[http-bio-127.0.0.1-8080-exec-45] [org.nuxeo.ecm.core.opencmis.bindings.NuxeoCmisServiceWrapper] org.nuxeo.ecm.core.api.DocumentSecurityException: Privilege 'Read' is not granted to 'cmis-user' org.nuxeo.ecm.core.api.DocumentSecurityException: Privilege 'Read' is not granted to 'highspot' at org.nuxeo.ecm.core.api.AbstractSession.checkPermission(AbstractSession.java:207) at org.nuxeo.ecm.core.api.AbstractSession.getWorkingCopy(AbstractSession.java:1831) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoPropertyData$NuxeoPropertyDataVersionSeriesCheckedOutId.getFirstValue(NuxeoPropertyData.java:911) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoPropertyData$NuxeoPropertyDataVersionSeriesCheckedOutId.getFirstValue(NuxeoPropertyData.java:898) at org.apache.chemistry.opencmis.commons.impl.server.AbstractCmisService.getIdProperty(AbstractCmisService.java:1359) at org.apache.chemistry.opencmis.commons.impl.server.AbstractCmisService.getObjectInfoIntern(AbstractCmisService.java:1185) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoCmisService.getObjectInfo(NuxeoCmisService.java:1022) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoCmisService.getObjectInfo(NuxeoCmisService.java:1011) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoCmisService.collectObjectInfo(NuxeoCmisService.java:1044) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoCmisService.getChildrenInternal(NuxeoCmisService.java:1722) at org.nuxeo.ecm.core.opencmis.impl.server.NuxeoCmisService.getChildren(NuxeoCmisService.java:1672)
After enabling the DEBUG log for CoreSession, it appears that the permission is denied on the Workspace document.
- depends on
-
NXP-22253 Fix object not found exception when accessing to a proxy with CMIS
-
- Resolved
-
