Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 477752

Summary:	Symlinks cause errors in "Link to Server" projects
Product:	[ECD] Orion	Reporter:	Andrew Audibert <aaudibert>
Component:	Server	Assignee:	Project Inbox <orion.server-inbox>
Status:	RESOLVED WONTFIX	QA Contact:
Severity:	normal
Priority:	P3	CC:	ahunter.eclipse, arthorne.eclipse, mamacdon, steve_northover
Version:	9.0
Target Milestone:	---
Hardware:	PC
OS:	Mac OS X
Whiteboard:

Description Andrew Audibert

2015-09-17 15:12:52 EDT

To reproduce, link the server to a directory (first set orion.file.allowedPaths in orion.conf to include this directory). In the directory, create (1) an inner directory and (2) a symlink to the inner directory. In Orion, you will be able to see both the symlink and the directory, but clicking the symlink in the navigator will result in Forbidden: /path/to/symlink/

Comment 1 Mark Macdonald

2015-09-17 15:33:10 EDT

I vaguely remember an intentional decision to prevent the server from following symlinks. Perhaps one of the server devs can recall more clearly.

Comment 2 Anthony Hunter

2015-09-17 15:57:12 EDT

We do not allow links in orion.file.allowedPaths or in fact any filesystem used by Orion.

Comment 3 Anthony Hunter

2015-09-17 16:00:25 EDT

(In reply to Anthony Hunter from comment #2)
> We do not allow links in orion.file.allowedPaths or in fact any filesystem
> used by Orion.

The original reason was that you could import a zip file containing links to ../.. and be able to hack into other projects. There was other reasons in terms of the metadata handling, so we limit to just supporting absolute directories and files.

Comment 4 Andrew Audibert

2015-09-17 19:47:18 EDT

Ah, that makes sense, thanks for explaining! Do you think it makes more sense to hide symlinks from the navigation view, or change the error message to say that symlinks are disallowed? Hiding them is nice for users who don't know about them since they can't use them anyway. However, if a user is looking for symlinks they know exist, they might prefer to get an error message so that they can understand where their symlinks disappeared to. 

Another possible improvement would be to support only symlinks which link to places within orion.file.allowedPaths.