[WebScript] exception raised by getPermissions

[leo]

Alfresco version 2.1

an AccessDeniedException occur when calling the ScriptNode.getPermissions() method.
it occurs only on given nodes such as companyhome, which are not fully accessible by the connected user.

Shouldn't it be handled by the API ?

to reproduce : companyhome.getPermissions() on any script.

Message:   Failed to execute script
'/dev/alfresco/WEB-INF/classes/alfresco/templates/webscripts/dev/test.get.js':
Wrapped org.alfresco.repo.security.permissions.AccessDeniedException: Access Denied. You do not have the appropriate permissions to perform this operation. (AlfrescoScript#4)

Exception:   net.sf.acegisecurity.AccessDeniedException - Access is denied.
   
   net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.java:86)
net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:394)
net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:238)
org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
…

[davidc]

an AccessDeniedException occur when calling the ScriptNode.getPermissions() method.
it occurs only on given nodes such as companyhome, which are not fully accessible by the connected user.

This is expected, but I tested anyway.  The appropriate Web Script error page is rendered with the appropriate exception.

Shouldn't it be handled by the API ?

How would you like it handled? I'm not sure I understand what the issue is.

If you want to protect your script against permissions, use the following method:

boolean hasPermission(string permission) ‍