[417507] [Security] Bypass READ permission checks for the

CDOResourceNode.name attribute 
https://bugs.eclipse.org/bugs/show_bug.cgi?id=417507

2 files changed, 12 insertions, 6 deletions

diff --git a/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/CDOItemProvider.java b/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/CDOItemProvider.java
index a487670ea2..8b5d50d155 100644
--- a/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/CDOItemProvider.java
+++ b/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/CDOItemProvider.java
@@ -58,6 +58,7 @@ import org.eclipse.net4j.util.event.IListener;
 import org.eclipse.net4j.util.ui.views.ContainerItemProvider;
 import org.eclipse.net4j.util.ui.views.IElementFilter;
 
+import org.eclipse.emf.common.util.EList;
 import org.eclipse.emf.ecore.EPackage;
 
 import org.eclipse.jface.action.IMenuManager;
@@ -176,7 +177,8 @@ public class CDOItemProvider extends ContainerItemProvider<IContainer<Object>>
 
     if (element instanceof CDOResourceFolder)
     {
-      return ((CDOResourceFolder)element).getNodes().toArray();
+      EList<CDOResourceNode> result = CDOUtil.filterReadables(((CDOResourceFolder)element).getNodes());
+      return result.toArray();
     }
 
     return super.getChildren(element);
diff --git a/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/widgets/SessionComposite.java b/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/widgets/SessionComposite.java
index 9ffdcd061d..839c608ba7 100644
--- a/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/widgets/SessionComposite.java
+++ b/plugins/org.eclipse.emf.cdo.ui/src/org/eclipse/emf/cdo/ui/widgets/SessionComposite.java
@@ -176,16 +176,20 @@ public class SessionComposite extends Composite
   {
     StringBuilder builder = new StringBuilder();
     builder.append(connectorDescription);
-    builder.append("?repositoryName="); //$NON-NLS-1$
-    builder.append(repositoryName);
-    if (automaticRegistry)
+    if (connectorDescription.contains("?")) //$NON-NLS-1$
     {
-      builder.append("&automaticPackageRegistry=true"); //$NON-NLS-1$
+      builder.append("&"); //$NON-NLS-1$
+    }
+    else
+    {
+      builder.append("?"); //$NON-NLS-1$
     }
 
+    builder.append("repositoryName="); //$NON-NLS-1$
+    builder.append(repositoryName);
     if (automaticRegistry)
     {
-      builder.append("&legacyModeDefault=true"); //$NON-NLS-1$
+      builder.append("&automaticPackageRegistry=true"); //$NON-NLS-1$
     }
 
     return builder.toString();