Publishing Error

[Heike Franosch]

Hi,

I just upgraded to Version 6.2.25 community edition.
Since then I cannot publish as editor any more because I

am not allowed to read nodes like:

 /jcr:system/jcr:versionStorage/d0/28/d8/d028d853-0cfa-4289-bf73-983e11b1c757/1.2/jcr:frozenNode

Do I have to adjust the role configuration?

Thanks for any help,

Heike

[Roman Kovařík]

Hi Heike,

It sounds like M6.2.24 issue https://jira.magnolia-cms.com/browse/MAGNOLIA-8570 but this one should be fixed in 6.2.25.

Regards

Roman

[Heike Franosch]

Thanks for the reply.

The actional error msg in log is e.g:

Caused by: info.magnolia.publishing.exception.PublicationException: <ul><li>null: 56159332-6c85-4593-b060-81ae8fdd6b5a</li></ul>

I debugged it down to frozen node in version store.

I tried giving rights on the version store, but this does not help. In demo.magnolia-cms.com those are also not set, so

this is not the right way.

[Roman Kovařík]

Hey again,

could you check if this might be related (any custom login module or credentials)?

Hope that helps

Roman

[Heike Franosch]

Hi,

yes, I have a custom jaas login module. And I think it is still working.

Having done some further investigation, I think it is the change in JcrExportCommand line 117:

from: final Node node = contentDecorator.wrapNode(getJCRNode(context));

to: final Node node = contentDecorator.wrapNode(getJCRNode(context, Permission.READ));

Now the getJCRNode is no longer executed in system context and thus fails in my installation.

What do I have to do, so my current user context has read permission on this node?

My user can see the version history of the node in principle, and on publishing a new version is generated as usual.

But probably this is still executed in system conetxt?

Thanks for any help,

Heike

[Roman Kovařík]

I was kind of able to reproduce issue only if the user doesn't have access to the original node in the website workspace (the permission check is done against that node, not against the version store).

Not sure how to run into this in the standard setup (the user would not see the node he doesn't have access to to trigger the publish action). Do you use a programatic process?

import info.magnolia.objectfactory.Components;

ctx = Components.getComponent(Context.class)
cm = Components.getComponent(info.magnolia.commands.CommandsManager.class);
command = cm.getCommand("publish")
command.setRepository("website");
command.setVersion("1.1")
command.setPath("/travel"); //logged in user doesn't have access to this node -> PublicationException: <ul><li>null: /travel</li></ul>
command.execute(ctx);

[Heike Franosch]

Hi,

thanks for your investigation :-)

I am using the default publish from admincentral. But I did some more debugging and I think

I found the source of my problem. I have a quite old intsallation.
My workspace.xml contained:

        <WorkspaceSecurity>
            <AccessControlProvider class="info.magnolia.cms.core.MagnoliaAccessProvider">
                <param name="permissionsClass" value="info.magnolia.cms.core.NodeTypeBasedPermissions" />
                <param name="nodeTypes" value="mgnl:page" />
            </AccessControlProvider>
        </WorkspaceSecurity>

The NodeTypeBasedPermissions uses a path resolver that resolves to something like

/system/versionStorage/d0/28/d8/d028d853-0cfa-4289-bf73-983e11b1c757/1.24/frozenNode

which is not in the permission list as it has no namespace prefix.

Removing the params for MagnoliaAccessProvider solved it. In the current distribution these

parameters are also no present, so it seems to be right to remove them.

Can you confirm this?

Thanks again for your time and help :-)

Heike

[Roman Kovařík]

Hi,

I'm glad you've found the source of the issue.

Looks like NodeTypeBasedPermissions are a workaround for an issue in Magnolia 4.5, see https://jira.magnolia-cms.com/browse/MAGNOLIA-4729.

Seems to be safe to remove this settings.

Best regards

Roman

[Heike Franosch]

Hi,

yes, it probably dates back to this issue :-) Quite old my installation, but keeps running ;-)

I am still happy with magnolia, you are all doing a good job.

Thanks, Heike