Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-30417

Check immediate parent when emptying trash

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 10.10
    • Fix Version/s: 10.10-HF49, 11.x, 2021.4
    • Component/s: Core
    • Release Notes Summary:
      Permissions on parent are checked before purging the trash.
    • Backlog priority:
      750
    • Sprint:
      nxplatform #36
    • Story Points:
      5

      Description

      The 'Empty Trash' button triggers the EmptyTrash operation which triggers the purgeDocumentsUnder method of the AbstractTrashService. The method takes the document from which children are being removed. The method checks to see if the caller has access – but it checks it on the parent of the document, not the document itself.

      The check should be on the document, not the parent, i.e.

      if (!session.hasPermission(parent.getRef(), SecurityConstants.REMOVE_CHILDREN)) {
                  return;
      }

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  PagerDuty

                  Error rendering 'com.pagerduty.jira-server-plugin:PagerDuty'. Please contact your Jira administrators.