problem with permissions in template -check for parent read?

[stk137]

given some search results I am trying to display a link to the parent space using child.parent.url.  If a user doesn't have permissions it throws an error.

ok, so I added a check for permissions

<#if child.parent.hasPermission("Read")>‍

but that line throws the same error.

So how can you check for permissions on the parent node when you may not have permissions on that node (and that's why you are checking in the first place) ?

child.inheritsPermissions won't work when it does inherit but adds permissions.


For reference here's some of the error:

Error during processing of the template 'get(parent) failed on instance of org.alfresco.repo.template.TemplateNode'.
…
freemarker.template.TemplateModelException: get(parent) failed on instance of org.alfresco.repo.template.TemplateNode
…
Caused by: org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied.  You do not have the appropriate permissions to perform this operation.
…

‍‍‍‍‍‍‍‍

[kevinr]

I see the problem! I think this will require a fix - under the covers the Template/JavaScript API should check the user has READ permissions on the parent before providing you a reference to it - and return null if it cannot be accesssed. That would make a simple null check to see if the parent is viable for access in the template/script.

I have raised a JIRA item for it:
http://issues.alfresco.com/browse/AR-1781

Thanks for spotting this,

Kevin

[dgenard]

Hi, I've the same problem from Java code as well.
My code looks like :

  NodeRef parentNodeRef = nodeService.getPrimaryParent(node.getNodeRef()).getParentRef();
  permissionService.hasPermission(parentNodeRef, …);‍‍

But if current user don't have READ permission on parent node, the first of both line throws an exception, and transaction is marked for rollback only. Alfresco release is 2.1.0E.
Is is possible to check for READ permission on parent node ?

Regards, Denis

[kevinr]

This was changed in 2.1.1E so that the call getPrimaryParent() is will not throw AccessDeniedException - instead you always get the relationship returned allowing you to inspect the permissions on the parent/child noderefs before accessing properties/content on them - that's how we fixed the jscript APIs also. You will need 2.1.1E.

Thanks,

Kevin