#264 Possible to Publish Form with Invalid ACL

[George Steimer]

Steps to recreate
1) Create a page set and setup the security to set a custom ACL on one of the states (ex: Pending Approval)
2) Create a PSI and route it to ensure that the ACL is set correctly. Archive the page set with the Page Set Archiver
3) Upload the page set to a docbase that doesn't include the ACL set in step #1. Note that if you manage the security, the state is listed as "Lifecycle Default", not the ACL that was set in step #1.
4) Create a PSI and route it - it will fail when it reaches the state with the custom ACL

We should fix this by adding a number of things in the admin

- When viewing the security in the admin, we shouldn't just display "Lifecycle Default" on states with ACLs that don't exist. We should display a warning message
- We should not allow the admin to publish a page set if one of the states points to an ACL that doesn't exist. A warning message should be displayed that tells the admin the issue and that it must be fixed before publishing.

[Anonymous]

Half of problem has been solved with a recent commit to admin_manage_security.jsp -- now when an ACL is removed and an admin goes to the manage security tab, there will be a notification next to the dropdown indicating that the acl is missing in the docbase. The second half of this problem will be solved when it is not possible to publish a pageset that has an acl assigned that does not exist in the docbase.