Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-29722

Fix EmptyTrash operation not deleting documents for users granted with the Everything permission

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Cannot Reproduce
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: Automation, Core

      Description

      I encountered this behaviour when trying to empty trashed documents in Web UI (using a non-administrator user with the Everything permission).

      Reproduction steps:

      • Using Administrator:
        1. Create a Workspace document ws.
        2. Create two File documents inside it: f1 & f2.
        3. Create a user User (no need to add to any group).
        4. In the permissions view for ws, define a new local permission to permanently grant the Manage everything permission to User (no need to send an email).
      • Using User:
        1. Access ws.
        2. Select both files and delete them.
        3. Switch to trash view -> the two documents will be there.
        4. Click Empty Trash -> both documents should be permanently deleted, but nothing happens.

      When Administrator (or any other user from the Administrators Group) clicks Empty Trash, both documents are permanently deleted.

      This can also be observed with curl requests:

      1. Check on the permissions for ws:
        curl -u Administrator:Administrator 'http://localhost:8080/nuxeo/api/v1/id/1de9fd2f-30da-48c9-8943-2b8afc80aa3d' \
          -H 'enrichers-document: acls'
        
        { 
          ... 
          "contextParameters": {
            "acls": [
              {
                "name":"local",
                "aces":[
                  {
                    "id":"User:Everything:true:Administrator::",
                    "username":"User",
                    "externalUser":false,
                    "permission":"Everything",
                    "granted":true,
                    "creator":"Administrator",
                    "begin":null,
                    "end":null,
                    "status":"effective"
                  }
                ]
              },
              ...
            ]
          }
        }
        
      2. Check the number of trashed documents for User (should be 2)
        curl -u User:User 'http://localhost:8080/nuxeo/api/v1/search/pp/advanced_document_content/execute?ecm_parentId=1de9fd2f-30da-48c9-8943-2b8afc80aa3d&ecm_trashed=true'
        
        {
          ...
          "resultsCount":2
          ...
        }
        
      3. Execute the EmptyTrash operation as User
        curl -u User:User -i 'http://localhost:8080/nuxeo/api/v1/automation/Document.EmptyTrash' \
          -H 'Content-Type: application/json' \
          --data-binary '{"params":{"parent":"1de9fd2f-30da-48c9-8943-2b8afc80aa3d"},"context":{}}'
        
        HTTP/1.1 204
        
      4. Recheck the number of trashed documents for User (should be 0, but it's still 2)
        curl -u User:User 'http://localhost:8080/nuxeo/api/v1/search/pp/advanced_document_content/execute?ecm_parentId=1de9fd2f-30da-48c9-8943-2b8afc80aa3d&ecm_trashed=true'
        
        {
          ...
          "resultsCount":2
          ...
        }
        
      5. Check the number of trashed documents for Administrator (should be 2)
        curl -u Administrator:Administrator 'http://localhost:8080/nuxeo/api/v1/search/pp/advanced_document_content/execute?ecm_parentId=1de9fd2f-30da-48c9-8943-2b8afc80aa3d&ecm_trashed=true'
        
        {
          ...
          "resultsCount":2
          ...
        }
        
      6. Execute the EmptyTrash operation as Administrator
        curl -u Administrator:Administrator -i 'http://localhost:8080/nuxeo/api/v1/automation/Document.EmptyTrash' \
          -H 'Content-Type: application/json' \
          --data-binary '{"params":{"parent":"1de9fd2f-30da-48c9-8943-2b8afc80aa3d"},"context":{}}'
        
        HTTP/1.1 204
        
      7. Recheck the number of trashed documents for Administrator (should be 0)
        curl -u Administrator:Administrator 'http://localhost:8080/nuxeo/api/v1/search/pp/advanced_document_content/execute?ecm_parentId=1de9fd2f-30da-48c9-8943-2b8afc80aa3d&ecm_trashed=true'
        
        {
          ...
          "resultsCount":0
          ...
        }
        

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 hours
                  2h