Description
The repository servlet throws an exception in case the query returns a node, which the user is not allowed to read.
Steps to reproduce:
1) Take the latest 7.9 archetype.
2) Make sure you use Hippo CMS 7.9.8
3) Set the repository property to the latest tag (2.26.16)
4) Start the project
5) Create a new root folder within document called "resourcebundles". A non-translated folder is fine.
6) Go to the console and import the attached facetrule to:
/hippo:configuration/hippo:domains/hippofolders/hippostd-folder/
/hippo:configuration/hippo:domains/hippodocuments/hippo-document/
Now log into the repository interface with the "editor" role.
Now perform the following query:
/jcr:root/content/documents//element(*,hippostd:folder)
This will result in a stracktrace, because the resourcebundle folder can't be read.
Attachments
Issue Links
- relates to
-
REPO-1337 Authorization query does not exclude all descendant nodes of node with id 'xyz' when there is a facet rule that says 'jcr:uuid != xyz'
- Closed