nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Setting file permission to read only

amir333

Hi,

Using Java webservices, when i set the edit file permission to false using NodePermissions. setEditPermissionsPermission, a user with edit permission on the parent folder of this file can still edit the "uneditable" file?

Is that because permissions are cumulative in ECM?

Is there a way to upload a file and set it to read only even if there are users who have edit permissions on the parent folder housing the file in question?

Thanks

Amir

Find more posts tagged with

Comments

sıɹɥɔ

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

Hi Amir,

Two things:

1. Once an item is created the permissions on its container ("parent folder") have no influence on further access to the item itself.

2. The permission you're setting, EditPermissions, is associated with the ability to change permissions on the item; this does not determine whether the item is read-only. For that you'll want to set the Modify permission.

Hope this helps,

-chris

From: eLink Entry: Enterprise Web Services 9.7.1 Forum [mailto:otdnenterprisewebservices971forum@elinkkc.opentext.com]
Sent: Tuesday, November 17, 2009 1:24 PM
To: eLink Recipient
Subject: Setting file permission to read only

Setting file permission to read only

Posted by amir.sharobim@gov.ab.ca (Sharobim, Amir) On 2009/11/17 14:22

Hi, Using Java webservices, when i set the edit file permission to false using NodePermissions. setEditPermissionsPermission, a user with edit permission on the parent folder of this file can still edit the "uneditable" file? Is that because permissions are cumulative in ECM? Is there a way to upload a file and set it to read only even if there are users who have edit permissions on the parent folder housing the file in question? Thanks Amir

[To post a comment, use the normal reply function]
Forum:	Enterprise Web Services 9.7.1 Forum
Livelink Server:	knowledge-wlweb01

amir333

Hi Chris,

I meant to say i used setModifyPermission(false) to make the file uneditable. but it is still not working.

Here is what i have done:

Node insertedNode = upd.fDocMan.getNodeByName(parentNode.getID(), "test.doc") ;

if (insertedNode != null) {

//update the file permission to read only

NodePermissions nodePermissions = insertedNode.getPermissions() ;

nodePermissions.setModifyPermission(false) ;

nodePermissions.setDeletePermission(false) ;

}

I am a little bit confused with your response to part 1. i thought when a document is added to a folder, it inherits permissions from the parent folder. so if a user has full rights on the parent folder then that user will have full rights on the added file as well!!!!!!

Would you be able to let me know how do i set a word document that i upload to ECM to be un-editable for user ? is that doable even when users have "add item" and "modify" permissions on the parent folder ?

Thanks

Amir

sıɹɥɔ

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

The word "inheritance" is to blame here. Programmers tend to think of this as a being a dynamic characteristic. However in Content Server "inheritance" refers only to the copying that happens at the time of creation. This happens once; further access to an item is not based on inheritance.

So you're correct that the permissions on a containing folder determines the permissions an item has, at creation. But from that point on the folder and the item have independent permissions. The permissions are not "cumulative". You can set permissions on the item knowing that the containing folder will not influence the ability for users to perform operations on the item.

-chris

From: eLink Entry: Enterprise Web Services 9.7.1 Forum [mailto:otdnenterprisewebservices971forum@elinkkc.opentext.com]
Sent: Wednesday, November 18, 2009 10:33 AM
To: eLink Recipient
Subject: RE Setting file permission to read only

RE Setting file permission to read only

Posted by amir.sharobim@gov.ab.ca (Sharobim, Amir) On 2009/11/18 11:31

Hi Chris, I meant to say i used setModifyPermission(false) to make the file uneditable. but it is still not working. Here is what i have done: Node insertedNode = upd.fDocMan.getNodeByName(parentNode.getID(), "test.doc") ; if (insertedNode != null) { //update the file permission to read only NodePermissions nodePermissions = insertedNode.getPermissions() ; nodePermissions.setModifyPermission(false) ; nodePermissions.setDeletePermission(false) ; } I am a little bit confused with your response to part 1. i thought when a document is added to a folder, it inherits permissions from the parent folder. so if a user has full rights on the parent folder then that user will have full rights on the added file as well!!!!!! Would you be able to let me know how do i set a word document that i upload to ECM to be un-editable for user ? is that doable even when users have "add item" and "modify" permissions on the parent folder ? Thanks Amir

amir333

Hi Chris,

It makes sense now. Thanks.

However, I am still not sure how to set a document's permission to read only using the Livelink enterprise webservices API. What i am trying to do is to set the permission on the uploaded document to read only for all users. Using the code below does not work. Do i have to update the permission of every user who have access to this document individually ? Thanks

...

NodePermissions nodePermissions = uploadedDocumentNode.getPermissions() ;

nodePermissions.setModifyPermission(false) ;

nodePermissions.setDeletePermission(false) ;

...

sgrasley

Hi, Amir.

Try calling all of the SetXPermission() methods, setting the value that you want. I think one of the defaults is clobbering what you're trying to do.

Thanks,

Scott

amir333

Hi Scott,

I tried setting all the permissions to false but still does not work.

I even tried your suggestion in another posting by getting all of the ACL node rights and setting the permissions of each to false but it still does not work.

Here is what i have done:

// first attempt

Node insertedNode = upd.fDocMan.getNodeByName(upd.nCurrNode.getID(), "efr12345.doc") ;

if (insertedNode != null) {

	//update the file permission to read only

	NodePermissions nodePermissions =  insertedNode.getPermissions() ;

	nodePermissions.setAddItemsPermission(false) ;

	nodePermissions.setDeletePermission(false) ;

	nodePermissions.setDeleteVersionsPermission(false) ;

	nodePermissions.setEditAttributesPermission(false) ;

	nodePermissions.setEditPermissionsPermission(false) ;

	nodePermissions.setModifyPermission(false) ;

	nodePermissions.setReservePermission(false) ;

	nodePermissions.setSeeContentsPermission(false) ;

	nodePermissions.setSeePermission(false) ;

// second attempt

List<NodeRight> rights = upd.fDocMan.getNodeRights(upd.nCurrNode.getID()).getACLRights() ;

for (NodeRight nr: rights) {

	NodePermissions nodePermissions = nr.getPermissions() ;

	nodePermissions.setAddItemsPermission(false) ;

	nodePermissions.setDeletePermission(false) ;

	nodePermissions.setDeleteVersionsPermission(false) ;

	nodePermissions.setEditAttributesPermission(false) ;

	nodePermissions.setEditPermissionsPermission(false) ;

	nodePermissions.setModifyPermission(false) ;

	nodePermissions.setReservePermission(false) ;

	nodePermissions.setSeeContentsPermission(false) ;

	nodePermissions.setSeePermission(false) ;

ChunkedOperationContext context = upd.fDocMan.updateNodeRightsContext(upd.nCurrNode.getID(),RightOperation.REPLACE,rights,RightPropagation.TARGET_ONLY) ;

upd.fDocMan.updateNodeRights(context) ;

// third attempt

used both of the first and second attempts together.

Carsten_Kulms

According to getPermissions returns only "the Permissions object representing theauthenticated user's permission on the node". So updating this onemodifies the permission of the currently authenticated user only.Working with NodeRights is the right approach but it has to be regardedthat NodeRights,, is a `complex` thing: "NodeRights represents the collection of rights associated with a node.There are fields for each of the core NodeRight types (OwnerRight,OwnerGroupRight, PublicRight) and an array of ACLRights."In your second attempt you update the ACL rights only. I guess you haveto update the other too, otherwise they may overrule the ACL rights.(E.g. if a member of the "OwnerGroup" accesses the node.)

Kyle_Swidrovich

Actually, there is a permission bit (7)that always needs to be set on an object to ensure that you will be able todelete its children at some point.

That’s why “nopermissions” actually equals 128 in the DB.

In that respect, even after permissions havebeen applied to an item, at the time of deletion, we still refer to the parentto check its “128” bit.

From: eLink Entry:Enterprise Web Services 9.7.1 Forum[mailto:otdnenterprisewebservices971forum@elinkkc.opentext.com]
Sent: Tuesday, November 17, 20097:56 PM
To: eLink Recipient
Subject: RE Setting filepermission to read only

RE Setting file permission to read only

Posted by cwebster (Webster, Chris) On 2009/11/17 14:55

Hi Amir,

Two things:

1. Once an item is created the permissions on its container ("parent folder") have no influence on further access to the item itself.

Hope this helps,

-chris

Setting file permission to read only

Posted by amir.sharobim@gov.ab.ca (Sharobim, Amir) On 2009/11/17 14:22

Hi,

Is that because permissions are cumulative in ECM?

Is there a way to upload a file and set it to read only even if there are users who have edit permissions on the parent folder housing the file in question?

Thanks

Amir

[To post a comment, use the normal reply function]
Forum:	Enterprise Web Services 9.7.1 Forum
Livelink Server:	knowledge-wlweb01

[To post a comment, use the normal reply function]
Topic:	Setting file permission to read only
Forum:	Enterprise Web Services 9.7.1 Forum
Livelink Server:	knowledge-wlweb01

amir333

Carsten,

I was able to make the uploaded file uneditable and not deleteable by removing permissions from the owner, group owner and every acl right using my second approach. Thanks.

Kyle,

I am not able to verify what you suggested regarding the deletion. i have a user (a local to livelink, lets call it webservice, i.e. not NT user) that has full permissions on the parent folder that houses the uploaded document. All edit and delete permissions on the document have been removed. i.e. the owner, the owner group and all of the ACL users only have access to see the document. When i attempt to delete the document using the webservice id, i get a permission denied message which what i am expecting but it is not behaving as you have described it. Am i missing something ?

Thanks

Amir

Kyle_Swidrovich

If you check the DTreeACL record(s) forthat item in the database, you will probably find that Content Server has stillapplied bit 7 to the mask automagically for you.

No permissions on the object should appearas 128 in the database.

The “Delete” permission is notthe same as the “Delete Children” permission. This extrapermission is hidden and not modifiable through the GUI or various APIs.

We noticed with LAPI that there is a wayto apply a permission bitmask to an object that unfortunately has bit 7off. In this case, or if developing in OScript, one must be careful toensure that the permission value applied to an item has bit 7 enabled.

From: eLink Entry:Enterprise Web Services 9.7.1 Forum[mailto:otdnenterprisewebservices971forum@elinkkc.opentext.com]
Sent: Thursday, November 19, 20095:29 PM
To: eLink Recipient
Subject: RE RE Setting filepermission to read only

RE RE Setting file permission to read only

Posted by amir.sharobim@gov.ab.ca (Sharobim, Amir) On 2009/11/19 12:23

Carsten,

I was able to make the uploaded file uneditable and not deleteable by removing permissions from the owner, group owner and every acl right using my second approach. Thanks.

Kyle,

Thanks

Amir

[To post a comment, use the normal reply function]
Topic:	Setting file permission to read only
Forum:	Enterprise Web Services 9.7.1 Forum
Livelink Server:	knowledge-wlweb01