node permissions not respected for search

[tim-erwin]

I have a webscript that does a search query like so:

params.addStore(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE);
params.setQuery("a simple lucene query");
ResultSet result = this.searchService.query(params);
‍‍‍‍‍

The search works great except that it does not respect the persmissions of the respective user. It returns items the user is not allowed to see. The description of the webscript is as follows:

<webscript>
   <shortname>Search the repository</shortname>
   <description></description>
   <url>/myPackage/search</url>
   <authentication>user</authentication>
   <transaction>none</transaction>
</webscript>
‍‍‍‍‍‍‍‍‍

I checked the SOAP API which uses pretty much the same call

StoreRef storeRef = Utils.convertToStoreRef(store);
searchResults = searchService.query(storeRef, query.getLanguage(), statement);
‍‍‍‍

There the permissions are checked. So this should not be a configuration issue.

How can I make the webscript respect the users' persmissions?

[afaust]

Hello,

if you have a Java-backed web script, please keep in mind to always configure it using public service beans (e.g. beans called "SearchService" / "NodeService" with an upper-cased initial letter) in your Spring configuration XML files. Only those service beans will have the security mechanism attached while the private service beans (lower-cased initial letter) are the actual implementation.

Regards
Axel
Axel