nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

unix-permission vs CCPro properties display

tanguyr

Hello,

I have some questions regarding folder/file permissions in TS 6.7.2 on Solaris 10:

First off; i want a file created in a folder to belong to that folder's group. I have enabled this using iw.cfg as explained elsewhere on these forums (setting directory_default_perm and using the sgid), and it works. My problem is that what i see on the command line when running iwaccess unix-permission [folder_vpath] is not what i see when i view the folder's properties in CCPro:

unix-permission shows me "rwxrwsr-x"
CCPro show me:
Owner: Write Only
Group: Read and Write
Others: Read and Write

Secondly, i also notice that SitePublisher operations (specifically "New Page") don't follow these unix settings, they (seem to) follow what i see in CCPro properties: a user who is not a member of the group that owns a folder can still create a page in that folder. The page is assigned to the group of the folder (so that works), but of course the user who created it is the owner so he/she can still edit it.

BTW, i have not made any changes to submit.cfg and iwtestcfg returns "No match" for the folder in question

Can anybody tell me how to

1) stop users from creating pages under a folder belonging to a group they are not a member of (without stopping them from reading the contents of these types of folders)?

and

2) get CCPro properties to show me something consistent wiht what iwaccess unix-permission (this is more a nice to have than a need to have)

Regs,
/t

Find more posts tagged with

Comments

Adam Stoller

On a hunch - I'd say what CCPro is showing is a bug that ought to be filed (by you) with Support - if the OS has rwxrwsr-x it should be:

The fact that SitePublisher is allowing someone who is not the owner of the folder and not a member of through group associated with that folder to create a file within that folder also seems like a bug which should be reported. My guess is that the SitePublisher process is running as someone other than the actual user but using a seteuid call to set the ownership after the fact - but that's just a guess.The fact that this user then owns the file and can continue to edit it agrees with the permissions on the folder (from a Unix perspective) - I don't see anything wrong with that.

tanguyr

Thank you for your reply. I have booked the two issues with support (i opened two cases). The fact that the user is the owner of the page he/she created is, as you point out, correct to expected behavior.

Whilst investigating furthur on this issue, i have discovered what i think is another bug with LiveSite/Sitepublisher: if a user does not have read access on every folder in a given site, he/she will not be able to edit the properties of any component on any page in the site. When opening the component edit dialog box (pop up window), i see a stack trace in the sevletd_out.log complaining that:


2008-11-26 14:45:58,023 ERROR com.interwoven.livesite.common.business.BusinessException - level [-1]
Failed to get Page
com.interwoven.cssdk.access.CSAuthorizationException: //bewcmi01/default/main/www_swift_com/WORKAREA/transport/sites/sdc/solutions/test(Permission denied)
        at com.interwoven.cssdk.sci.exception.ExceptionHandler.handleExceptionSci(ExceptionHandler.java:185)
        at com.interwoven.cssdk.sci.filesys.CSFile.getDirectoryContents(CSFile.java:4219)
...snip...

So it looks to me like Sitepublisher is trying to use cssdk to list the content of every directory under sites, which throws an error when it encounters a folder whose contents it can't list based on the permissions of the logged in user). This also explains (in my mind) why sitepublisher gets slower and slower as more folders are added to a site.

Just to be clear, i am trying to edit a component on a page which is in a totally different area of the site not related to the folder which i can't access - i.e. error is thrown because system can't access


/default/main/www_swift_com/WORKAREA/transport/sites/sdc/solutions/test

but i am trying to edit a component on page


/default/main/www_swift_com/WORKAREA/transport/sites/sdc/home/index.page

Have you ever encountered this kind of problem?

Regs,
/t

tanguyr

OK, so the first issue (CCpro shows wrong permissions for folders with sgid) is a bug in TeamSite. Support booked it as TS-5185

tanguyr

The third issue (if a user does not have read access on every folder in a given site, he/she will not be able to edit the properties of any component on any page in the site) is a bug in LiveSite. Support booked it as LST-5194.

tanguyr

trifecta: the second issue (SitePublisher operations don't take unix folder permissions into account) is also a bug - bug id is LST-5454