Uploaded image for project: 'ModeShape'
  1. ModeShape
  2. MODE-2210

Session.getNodeByIdentifier does not check ACLs

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • 4.0.0.Alpha3, 3.7.4.Final, 3.8.0.Final
    • 3.4.0.Final, 3.5.0.Final, 3.6.0.Final, 3.6.1.Final, 3.7.0.Final, 3.7.1.Final, 3.7.2.Final, 4.0.0.Alpha2, 3.7.3.Final
    • JCR
    • None

      The Session.getNodeByIdentifier(String) method and the deprecated Session.getNodeByUUID(String) method do not check ACLs. This is not a problem when a repository does not use ACLs, but when it does these methods provide a security hole.

              rhauch Randall Hauch (Inactive)
              rhauch Randall Hauch (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: