Deny Remove permission but Delete button still enabled

ChristopheL_

Hello,

I have just dowloaded and installed Nuxeo Document Management 5.5 and I tried what is described at http://doc.nuxeo.com/display/DMDOC/Managing+access+rights about access rights management.

So I did the following steps:

As Administrator

• login
• create a John Do user
• create a workspace
• On the Manage tab, add two permissions: John Do - Grant - Write + John Do - Deny - Remove
• create a note in the workspace

as John Do user

• login
• go to the workspace created above as Administrator
• check the box in front of the Note created above as Administrator => the Delete button is enabled so the user John Do can remove the document

Question: Is it normal that the Delete button is enabled even if there is a Deny - Remove permission on the workspace for the user ?

I would have expected that the user won't be able to delete any document.

Thanks in advance for your answer

Best regards, Christophe

Solen_Guitter

Hello,

This is due to the access rights priorization, as explained on this page: http://doc.nuxeo.com/x/UYEk.

In this case, the user still has the right to remove documents because at the same level (in the same workspace) he's denied the right to delete documents, but he's also granted the Write permission. Since Write includes the Remove permission and granted rights win over denied rights, in the end the user is granted the right to remove.