Uploaded image for project: 'Service Packs and Hot Fixes'
  1. Service Packs and Hot Fixes
  2. MNT-15655

Possible to violate child cm:name uniqueness constraint via NodeService.addAspect

    Details

      Description

      For child associations that specify duplicate=false (like cm:contains in the type cm:folder), the NodeService API is supposed to enforce a uniqueness constraint regarding the cm:property over all child nodes of the same (primary) parent. This enforcement works for the operations createNode, setProperty, setProperties and addProperties, but can be circumvented via the addAspect operation.

      The addAspect operation takes a map of property values which it will apply to the node being modified without regard to any relationship between the properties and the aspect (it is possible to pass ANY properties - they need not be defined by the aspect being added). When the map of property values contains a new cm:name value, that property is updated in alf_node_properties table but the uniqueness constraint is not checked / enforced.

      Steps to reproduce:

      • via Share UI (JavaScript console installed)
      • create a folder in the Repository view with name "XYZ"
      • create a second folder with name "XYZ2" in the same location
      • copy/remember the NodeRef of the second folder
      • open up JavaScript console and execute the following script
        var node = search.findNode('_insert NodeRef_');
        node.addAspect('cm:author', { 'cm:name' : 'XYZ'});
        

      Expected result: The script fails with a DuplicateChildNodeNameException
      Observed result: The script succeeds and we end up with two folders with identical name.

      As far as I can see this bug has been in Alfresco for a very long time (at least since 3.x). One might argue that addAspect should only be used to add aspect-related properties (developer mistake). But that operation never restricted the set of properties to be set and it should not start to now in order to maintain compatibility.

      The only call missing in the addAspect operation is a call to the setPropertiesCommonWork internal operation that performs the proper update of the primary parent association based on cm:name.

        Attachments

          Activity

            People

            • Assignee:
              closedbugs Closed Bugs
              Reporter:
              afaust Axel Faust
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 4 hours, 5 minutes
                4h 5m