Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-30872

Current document is missing from context in file download permission for renditions

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 2021.0
    • Fix Version/s: None
    • Component/s: Renditions, Rest API

      Description

      Download permissions for renditions are very limited because the document is missing from the context. Unlike the PreviewAdapter, the RenditionAdapter doesn't explicitly verify file download permissions and only passes the renditionName to the download servlet so part of context is lost.

      One could argue that a rendition configuration contains an action filter in the first place but:

      • xml configuration and EL expressions are not as versatile as a JS script
      • configuration must potentially be duplicated, one for stored blobs and one for renditons.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:

                PagerDuty

                Error rendering 'com.pagerduty.jira-server-plugin:PagerDuty'. Please contact your Jira administrators.