Description
When computing the results, items are filtered according to the access right of the current user on that document, so that unaccessible documents are not listed among the search results. However, this fails in a certain situation: searching from the global wiki, logged in with a global account without administrator rights, and filtering results in a local wiki, which has an explicit "allow" rights setting for all local and global users.
The problem is that when performing the rights check, the plugin changes the context wiki, but without updating the username to include the "xwiki:" prefix, thus the rights are checked for a non-existing user in the local wiki.
Attachments
Issue Links
- relates to
-
XWIKI-4106 Different results for $xwiki.checkAccess and $xwiki.hasAccessLevel
- Closed