Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-1541

Inconsistent permission checking in PackageAPI

    XMLWordPrintable

Details

    • Bug
    • Resolution: Won't Fix
    • Minor
    • None
    • 1.1 M3
    • {Unused} Core
    • None
    • plugin package rights

    Description

      In constructor:

          public PackageAPI(Package plugin, XWikiContext context) throws PackageException {
              super(context);
              if (!hasAdminRights())
                  throw new PackageException(XWikiException.ERROR_XWIKI_ACCESS_DENIED, "Admin right is needed to use this plugin");
              setPlugin(plugin);
          }
      

      Then in getPackage:

          public Package getPackage()
          {
              if (hasProgrammingRights())
                  return plugin;
              return null;
          }
      

      If the plugin isn't saved into the local variable unless the user has admin rights, getPackage should also be checking for Admin rights.

      Attachments

        Activity

          People

            sdumitriu Sergiu Dumitriu
            ebullient Erin Schnabel
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: