sakaiproject/nakamura — pull request #393 by zathomas (2011-11-09 20:19:41+00:00)
Title: Fix inadequate permission to modify members on content

KERN-2337 rewrite the POST method so it is coherent and precise (and not broken)

ManageMembersContentPoolServlet had gotten really confusing, so I did what any enterprising engineer would do: drew a flowchart!

http://aeroplane.s3.amazonaws.com/content-members.pdf

The real cause of the bug is that the servlet relied on a solr query to get "all groups I manage" and the results of that were not correct. Luckily we don't actually have to know all the groups I manage; We just have to know: do I have write permission on all of the groups which I am trying to remove as viewers?