Re: [Exist-development] And yet another security/Ant issue...IT's A BUG IN SECURITY!

[Andrzej J. T. <an...@ch...>]

Wolfgang:

> The bug is easy to reproduce and you don't need Ant for it:
> 
> 1) Launch a clean db
> 2) Use the Java admin client to create a user "administrator" and
> assign it to the dba group
> 3) Log into the client as "administrator" and try to trigger a
> shutdown -> permission denied!
> 4) Stop and restart the db
> 5) Repeat step 3) -> you are now allowed to shutdown

Yup....as I had mentioned you can do the same thing with the Admin Web App. Thanks for corroborating
this.

So like I said....it's a security/permissions bug, Dmitry! ;-)

LOL

-- 
Andrzej Taramina
Chaeron Corporation: Enterprise System Solutions
http://www.chaeron.com