security issue

[pmarreddy]

hi,

i have created a node with user: admin and tryed to access it using user: user1, i am able to access it, even when i set to read permission to false.

accoring to the wiki the

"on the NodeService bean, the readProperties method checks that the current user has read access to the properties of the node before invoking the method. On the SearchService, the results from queries are restricted to return only the nodes for which a user has read permission. "



my question is how can i set alfresco to automattically check the permission using "aop" i.e as quoted above.

[andy]

Hi

It would help to know the repository version and what you are doing.

If you are using version 1.1.1 you need to use version 1.1.2 to fix a security issue about permission enforcement.

If you are using the 1.0 open version, permissions were not included in this release.

If you are using the API direct, only the public service beans apply permission. There are two versions of these public beans. For example, "nodeService" and "NodeService". "nodeService" does not apply security, it is wrapped by "NodeService" which applies security. The same pattern applies to "searchService" and "SearchService".

Regards

Andy

[pmarreddy]

thank u for ur promt reply.

prasanth