topic Search API doesnt enforce permissions on Document links in Alfresco Forum

Search API doesnt enforce permissions on Document links

mire323 — Thu, 19 Mar 2020 18:14:42 GMT

Hello,

first of all thanks for reading my question!

When i create link to a document in share and want to get it in share it inherits permissions from an original document, but when i use search/nodes api it returns links to documents/folders regardless of permissions to original documents/folders so when users try to follow those links the get 403 error.

Can i add some condition to query so it woudnt return links to documents which user has no permission to see.

I will add pictures below:

Re: Search API doesnt enforce permissions on Document links

angelborroy — Fri, 20 Mar 2020 08:48:31 GMT

You can exclude links by adding something like the following clause to your queries:

-TYPE:"app:filelink"

Re: Search API doesnt enforce permissions on Document links

mire323 — Sun, 19 Apr 2020 18:59:03 GMT

I want to get links, but only ones i have right to see.

Re: Search API doesnt enforce permissions on Document links

afaust — Mon, 20 Apr 2020 16:17:41 GMT

What Alfresco Share does in filtering the link objects is not part of the regular permission model handling. It is a convenience filtering specific to the Share document library UI. You could use other operations in Alfresco Share, e.g. search, and would be able to find / access the link.
This convenience handling is of course missing in the ReST API, which simply returns all elements you are allowed to see. From a permission model perspective, you are allowed to see the link, but not the target. So the API of course returns you the link and its details.

This is all behaviour as designed and this issue is one of the known drawbacks of using link nodes via APIs which where not designed to apply any special logic to them.

Re: Search API doesnt enforce permissions on Document links

mire323 — Wed, 22 Apr 2020 12:41:37 GMT

Thank you soo much for explaining that in such great detail!