|
| Description: |
xwiki-platform/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/java/org/xwiki/attachment/internal/refactoring/job /MoveAttachmentJob.java 中的moveAttachment函数需要removeAttachment(sourceAttachment)。
但在权限校验（checkMoveRights(source, destination)）的时候只检查了EDIT和VIEW（hasSourceRight = hasAccess(Right.VIEW, source) && hasAccess(Right.EDIT, source);），并非DELETE权限。
而在xwiki-platform/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-api/src/main/java/org/xwiki/security/authorization /Right.java中可以看到EDIT和DELETE并无从属关系，因此权限校验存在错位。 |
| Attachment: |
xwiki.pdf |
| Component: |
12.10 |
|
