Node ordering is not preserved when using rep:glob ACLs | AEM 6.0-6.2, Oak 1.x

ค้นหา

อัปเดตครั้งล่าสุดเมื่อ 21 ธ.ค. 2021

Issue

When you grant a user (or group) access to an ordered JCR parent node but not to the child nodes, then when the user logs in who has that access the child node ordering under that node is not preserved.
Here's an example demonstrating the issue:

Create a sling:OrderedFolder folder called "mysites".
Create seven pages in the above folder called "one", "two", ... , "seven".
Create two new groups -- testGroup and testGlobalGroup.
Create a "testUser" account and add it as member of the two groups in step 3.

Add the following permissions for testGlobalGroup.

 "read" for "/"
          "read" for "/content/mysites" with glob for "jcr:primaryType"
          "read" for "/content/mysites" with glob for ""

Add the following permissions for the testGroup:

deny read access for the page "two", "four" and "six"

Cause

This is due to a bug in Oak JCR repository where the rep:glob ACLs get applied to hidden properties - https://issues.apache.org/jira/browse/OAK-5354.

Resolution

This is fixed in AEM6.3 and later versions.

However, you can work around this bug in older versions by doing the following:

Go to http://host:port/crx/de/index.jsp and log in as admin.
Browse to the parent node.
Click on the "Access Control" tab on the bottom right panel.
Create the following Access Control Entry by clicking the green plus icon in the
Allow, jcr:read, rep:glob=/:childOrder.