Merged V3.1 to HEAD

14955: Merged V2.2 to V3.1
      14352: Fixed ETWOTWO-1113: Creation date / modification date reset to current date during import
   14956: Fix for ETHREEOH-2198 and ALFCOM-2972
           - Thumbnail Service now allows creation of system managed thumbnails nodes by Consumer users or on Locked items
           - Explicit permission check to ensure user must at least be able to Read the original doc
           - Now correctly ensures that the 'modifier' properties are not updated on the original doc due to thumbnail generation

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@14957 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

config/alfresco/hibernate-context.xml

@@ -388,6 +388,9 @@
       <property name="auditableTransactionHelper">
          <ref bean="auditableTransactionHelper" />
       </property>
+      <property name="behaviourFilter">
+         <ref bean="policyBehaviourFilter" />
+      </property>
       <property name="sessionFactory">
          <ref bean="sessionFactory" />
       </property>

config/alfresco/thumbnail-service-context.xml

@@ -38,9 +38,11 @@
     
     <!-- Thumbnail service implemenation bean -->
     <bean id="thumbnailService" class="org.alfresco.repo.thumbnail.ThumbnailServiceImpl">
-    	<property name="nodeService" ref="NodeService"/>
+    	<property name="nodeService" ref="nodeService"/>
-    	<property name="contentService" ref="ContentService"/>
+    	<property name="contentService" ref="contentService"/>
+    	<property name="permissionService" ref="PermissionService"/>
     	<property name="mimetypeMap" ref="mimetypeService"/>
+    	<property name="behaviourFilter" ref="policyBehaviourFilter" />
     	<property name="thumbnailRegistry" ref="thumbnailRegistry" />
     </bean>   
     

source/java/org/alfresco/repo/domain/AuditableProperties.java

@@ -208,6 +208,65 @@ public class AuditableProperties
         auditModified = dateStr;
     }
 
+    /**
+     * Set all <b>cm:auditable</b> parameters as required, giving precedence to the supplied
+     * property map.
+     * 
+     * @param user          the username
+     * @param date          the creation or modification date
+     * @param properties    the properties to override the user and date
+     */
+    public void setAuditValues(String user, Date date, Map<QName, Serializable> properties)
+    {
+        String dateStr = DefaultTypeConverter.INSTANCE.convert(String.class, date);
+        if (properties.containsKey(ContentModel.PROP_CREATOR))
+        {
+            auditCreator = DefaultTypeConverter.INSTANCE.convert(
+                    String.class,
+                    properties.get(ContentModel.PROP_CREATOR));
+        }
+        else if (auditCreator == null)
+        {
+            auditCreator = user;
+        }
+        if (properties.containsKey(ContentModel.PROP_MODIFIER))
+        {
+            auditModifier = DefaultTypeConverter.INSTANCE.convert(
+                    String.class,
+                    properties.get(ContentModel.PROP_MODIFIER));
+        }
+        else if (auditModifier == null)
+        {
+            auditModifier = user;
+        }
+        if (properties.containsKey(ContentModel.PROP_CREATED))
+        {
+            auditCreated = DefaultTypeConverter.INSTANCE.convert(
+                    String.class,
+                    properties.get(ContentModel.PROP_CREATED));
+        }
+        else if (auditCreated == null)
+        {
+            auditCreated = dateStr;
+        }
+        if (properties.containsKey(ContentModel.PROP_MODIFIED))
+        {
+            auditModified = DefaultTypeConverter.INSTANCE.convert(
+                    String.class,
+                    properties.get(ContentModel.PROP_MODIFIED));
+        }
+        else if (auditModified == null)
+        {
+            auditModified = dateStr;
+        }
+        if (properties.containsKey(ContentModel.PROP_ACCESSED))
+        {
+            auditAccessed = DefaultTypeConverter.INSTANCE.convert(
+                    String.class,
+                    properties.get(ContentModel.PROP_ACCESSED));
+        }
+    }
+    
     /**
      * For persistance use
      */

source/java/org/alfresco/repo/importer/ImporterComponentTest.java

@@ -26,14 +26,25 @@ package org.alfresco.repo.importer;
 
 import java.io.InputStream;
 import java.io.InputStreamReader;
+import java.io.Serializable;
+import java.util.List;
+import java.util.Map;
 
+import org.alfresco.model.ContentModel;
 import org.alfresco.repo.security.authentication.AuthenticationComponent;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.service.ServiceRegistry;
+import org.alfresco.service.cmr.repository.ChildAssociationRef;
+import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.repository.StoreRef;
+import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
 import org.alfresco.service.cmr.view.ImporterService;
 import org.alfresco.service.cmr.view.Location;
 import org.alfresco.service.cmr.view.ImporterBinding.UUID_BINDING;
+import org.alfresco.service.namespace.NamespaceService;
+import org.alfresco.service.namespace.QName;
+import org.alfresco.service.namespace.RegexQNamePattern;
 import org.alfresco.util.BaseSpringTest;
 import org.alfresco.util.debug.NodeStoreInspector;
 
@@ -71,8 +82,7 @@ public class ImporterComponentTest extends BaseSpringTest
     }
     
     
-    public void testImport()
+    public void testImport() throws Exception
-        throws Exception
     {
         InputStream test = getClass().getClassLoader().getResourceAsStream("org/alfresco/repo/importer/importercomponent_test.xml");
         InputStreamReader testReader = new InputStreamReader(test, "UTF-8");
@@ -81,6 +91,56 @@ public class ImporterComponentTest extends BaseSpringTest
         System.out.println(NodeStoreInspector.dumpNodeStore(nodeService, storeRef));
     }
     
+    public void testImportWithAuditableProperties() throws Exception
+    {
+        InputStream test = getClass().getClassLoader().getResourceAsStream("org/alfresco/repo/importer/importercomponent_test.xml");
+        InputStreamReader testReader = new InputStreamReader(test, "UTF-8");
+        Location location = new Location(storeRef);
+        try
+        {
+            importerService.importView(
+                    testReader,
+                    location,
+                    null,
+                    new ImportTimerProgress());
+        }
+        finally
+        {
+            testReader.close();
+        }
+        
+        NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
+        List<ChildAssociationRef> childAssocs = nodeService.getChildAssocs(
+                rootNodeRef,
+                RegexQNamePattern.MATCH_ALL,
+                new RegexQNamePattern(NamespaceService.CONTENT_MODEL_1_0_URI, "SpaceWith.*"));
+//                QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "SpaceWithAuditable"));
+        assertEquals("'SpaceWith*' path not found", 2, childAssocs.size());
+        
+        NodeRef nodeRef = childAssocs.get(0).getChildRef();
+        Map<QName, Serializable> nodeProps = nodeService.getProperties(nodeRef);
+        String createdDate = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_CREATED));
+        String creator = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_CREATOR));
+        String modifiedDate = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_MODIFIED));
+        String modifier = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_MODIFIER));
+        // Check that the cm:auditable properties are correct
+        assertEquals("cm:created not preserved during import", "2009-05-01T00:00:00.000+01:00", createdDate);
+        assertEquals("cm:creator not preserved during import", "Import Creator", creator);
+        assertEquals("cm:modified not preserved during import", "2009-05-02T00:00:00.000+01:00", modifiedDate);
+        assertEquals("cm:modifier not preserved during import", "Import Modifier", modifier);
+        
+        nodeRef = childAssocs.get(1).getChildRef();
+        nodeProps = nodeService.getProperties(nodeRef);
+        createdDate = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_CREATED));
+        creator = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_CREATOR));
+        modifiedDate = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_MODIFIED));
+        modifier = DefaultTypeConverter.INSTANCE.convert(String.class, nodeProps.get(ContentModel.PROP_MODIFIER));
+        // Check that the cm:auditable properties are correct
+        assertEquals("cm:created not preserved during import", "2009-05-01T00:00:00.000+01:00", createdDate);
+        assertEquals("cm:creator not preserved during import", "Import Creator", creator);
+        assertEquals("cm:modifier not preserved during import", AuthenticationUtil.getSystemUserName(), modifier);
+    }
+    
     public void testImportWithUuidBinding() throws Exception
     {
         Location location = new Location(storeRef);

source/java/org/alfresco/repo/importer/importercomponent_test.xml

@@ -78,6 +78,26 @@
       <cm:content>contentUrl=classpath:org/alfresco/repo/importer/importercomponent_testfile.txt|mimetype=text|size=|encoding=</cm:content>
    </cm:content>
    
+   <cm:folder view:childName="cm:SpaceWithAuditable">
+      <view:aspects>
+         <cm:auditable/>
+      </view:aspects>
+      <cm:name>SpaceWithAuditable</cm:name>
+      <cm:created>2009-05-01T00:00:00.000+01:00</cm:created>
+      <cm:creator>Import Creator</cm:creator>
+      <cm:modified>2009-05-02T00:00:00.000+01:00</cm:modified>
+      <cm:modifier>Import Modifier</cm:modifier>
+   </cm:folder>
+   
+   <cm:folder view:childName="cm:SpaceWithPartialAuditable">
+      <view:aspects>
+         <cm:auditable/>
+      </view:aspects>
+      <cm:name>SpaceWithPartialAuditable"</cm:name>
+      <cm:created>2009-05-01T00:00:00.000+01:00</cm:created>
+      <cm:creator>Import Creator</cm:creator>
+   </cm:folder>
+   
    <cm:folder view:id="ML Text">
       <view:aspects>
          <cm:auditable/>

source/java/org/alfresco/repo/node/db/hibernate/HibernateNodeDaoServiceImpl.java

@@ -73,6 +73,7 @@ import org.alfresco.repo.domain.hibernate.SessionSizeResourceManager;
 import org.alfresco.repo.domain.hibernate.StoreImpl;
 import org.alfresco.repo.domain.hibernate.TransactionImpl;
 import org.alfresco.repo.node.db.NodeDaoService;
+import org.alfresco.repo.policy.BehaviourFilter;
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.repo.security.permissions.ACLType;
 import org.alfresco.repo.security.permissions.AccessControlListProperties;
@@ -191,6 +192,7 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
     private DictionaryService dictionaryService;
     private boolean enableTimestampPropagation;
     private RetryingTransactionHelper auditableTransactionHelper;
+    private BehaviourFilter behaviourFilter;
     /** A cache mapping StoreRef and NodeRef instances to the entity IDs (primary key) */
     private SimpleCache<EntityRef, Long> storeAndNodeIdCache;
     /** A cache for more performant lookups of the parent associations */
@@ -311,6 +313,16 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
         this.auditableTransactionHelper = auditableTransactionHelper;
     }
 
+    /**
+     * Set the component to determine the correct aspect behaviours.  This applies
+     * particularly to the <b>cm:auditable</b> case, where the setting of values
+     * is done automatically except when the behaviour is disabled.
+     */
+    public void setBehaviourFilter(BehaviourFilter behaviourFilter)
+    {
+        this.behaviourFilter = behaviourFilter;
+    }
+
     /**
      * Ste the transaction-aware cache to store Store and Root Node IDs by Store Reference
      * 
@@ -839,22 +851,57 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
         }
     }
 
+    /**
+     * Record the node update, setting the node's <b>cm:auditable</b> properties.
+     * The <b>cm:auditable</b> properties set implicity if the automatic behaviour
+     * {@link BehaviourFilter#isEnabled(NodeRef, QName) behaviour} is enabled.
+     * 
+     * @see #recordNodeUpdate(Node, Map)
+     */
     private void recordNodeUpdate(Node node)
+    {
+        recordNodeUpdate(node, null);
+    }
+    
+    /**
+     * Record the node update, setting the node's <b>cm:auditable</b> properties.
+     * The <b>cm:auditable</b> properties set implicity if the automatic behaviour
+     * {@link BehaviourFilter#isEnabled(NodeRef, QName) behaviour} is enabled,
+     * otherwise the properties are extracted from the properties passed in.
+     * 
+     * @param node          the node to operate on
+     * @param properties    the node properties from which <b>cm:auditable</b> properties
+     *                      may be extracted
+     */
+    private void recordNodeUpdate(Node node, Map<QName, Serializable> properties)
     {
         updateNodeStatus(node, false);
         // Handle cm:auditable
         if (hasNodeAspect(node, ContentModel.ASPECT_AUDITABLE))
         {
-            String currentUser = getCurrentUser();
+            NodeRef nodeRef = node.getNodeRef();
-            Date currentDate = new Date();
             AuditableProperties auditableProperties = node.getAuditableProperties();
             if (auditableProperties == null)
             {
                 auditableProperties = new AuditableProperties();
                 node.setAuditableProperties(auditableProperties);                
             }
+            String currentUser = getCurrentUser();
+            Date currentDate = new Date();
+            // Check if the cm:auditable aspect behaviour is enabled
+            if (behaviourFilter.isEnabled(nodeRef, ContentModel.ASPECT_AUDITABLE))
+            {
+                // Automatic cm:auditable behaviour
                 auditableProperties.setAuditValues(currentUser, currentDate, false);
             }
+            else if (properties != null)
+            {
+                // Manual cm:auditable behaviour
+                node.getAuditableProperties().setAuditValues(currentUser, currentDate, properties);
+            }
+            // else
+            //      there are no properties, so there is nothing to set
+        }
         // Propagate timestamps
         propagateTimestamps(node);
     }
@@ -1398,7 +1445,9 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
         addNodePropertyImpl(node, qname, propertyValue, localeId);
         
         // Record change ID
-        recordNodeUpdate(node);
+        recordNodeUpdate(
+                node,
+                Collections.singletonMap(qname, propertyValue));
     }
     
     @SuppressWarnings("unchecked")
@@ -1410,12 +1459,16 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
         for (Map.Entry<QName, Serializable> entry : properties.entrySet())
         {
             QName qname = entry.getKey();
+            if (AuditableProperties.isAuditableProperty(qname))
+            {
+                continue;
+            }
             Serializable value = entry.getValue();
             addNodePropertyImpl(node, qname, value, localeId);
         }
         
         // Record change ID
-        recordNodeUpdate(node);
+        recordNodeUpdate(node, properties);
     }
 
     public void setNodeProperties(Long nodeId, Map<QName, Serializable> propertiesIncl)
@@ -1477,7 +1530,7 @@ public class HibernateNodeDaoServiceImpl extends HibernateDaoSupport implements
         }
         
         // Record change ID
-        recordNodeUpdate(node);
+        recordNodeUpdate(node, propertiesIncl);
     }
 
     public void removeNodeProperties(Long nodeId, Set<QName> propertyQNamesIncl)

source/java/org/alfresco/repo/thumbnail/ThumbnailServiceImpl.java

@@ -33,6 +33,9 @@ import java.util.Map;
 
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.content.MimetypeMap;
+import org.alfresco.repo.policy.BehaviourFilter;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
+import org.alfresco.repo.security.permissions.AccessDeniedException;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
 import org.alfresco.service.cmr.repository.ContentData;
 import org.alfresco.service.cmr.repository.ContentReader;
@@ -41,6 +44,8 @@ import org.alfresco.service.cmr.repository.ContentWriter;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.repository.TransformationOptions;
+import org.alfresco.service.cmr.security.AccessStatus;
+import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.cmr.thumbnail.ThumbnailException;
 import org.alfresco.service.cmr.thumbnail.ThumbnailParentAssociationDetails;
 import org.alfresco.service.cmr.thumbnail.ThumbnailService;
@@ -71,9 +76,15 @@ public class ThumbnailServiceImpl implements ThumbnailService
     /** Content service */
     private ContentService contentService;
     
+    /** Permission service */
+    private PermissionService permissionService;
+    
     /** Mimetype map */
     private MimetypeMap mimetypeMap;
     
+    /** Behaviour filter */
+    private BehaviourFilter behaviourFilter;
+    
     /** Thumbnail registry */
     private ThumbnailRegistry thumbnailRegistry;
     
@@ -97,6 +108,14 @@ public class ThumbnailServiceImpl implements ThumbnailService
         this.contentService = contentService;
     }
     
+    /**
+     * @param permissionService permission service
+     */
+    public void setPermissionService(PermissionService permissionService)
+    {
+        this.permissionService = permissionService;
+    }
+    
     /**
      * Sets the mimetype map
      * 
@@ -107,6 +126,14 @@ public class ThumbnailServiceImpl implements ThumbnailService
         this.mimetypeMap = mimetypeMap;
     }
     
+    /**
+     * @param behaviourFilter  policy behaviour filter 
+     */
+    public void setBehaviourFilter(BehaviourFilter behaviourFilter)
+    {
+        this.behaviourFilter = behaviourFilter;
+    }
+    
     /**
      * Set thumbnail registry
      * 
@@ -136,7 +163,8 @@ public class ThumbnailServiceImpl implements ThumbnailService
     /**
      * @see org.alfresco.service.cmr.thumbnail.ThumbnailService#createThumbnail(org.alfresco.service.cmr.repository.NodeRef, org.alfresco.service.namespace.QName, java.lang.String, org.alfresco.service.cmr.repository.TransformationOptions, java.lang.String, org.alfresco.service.cmr.thumbnail.ThumbnailParentAssociationDetails)
      */
-    public NodeRef createThumbnail(NodeRef node, QName contentProperty, String mimetype, TransformationOptions transformationOptions, String thumbnailName, ThumbnailParentAssociationDetails assocDetails)
+    public NodeRef createThumbnail(final NodeRef node, final QName contentProperty, final String mimetype,
+            final TransformationOptions transformationOptions, final String thumbnailName, final ThumbnailParentAssociationDetails assocDetails)
     {
         // Parameter check
         ParameterCheck.mandatory("node", node); 
@@ -149,7 +177,10 @@ public class ThumbnailServiceImpl implements ThumbnailService
             logger.debug("Creating thumbnail (node=" + node.toString() + "; contentProperty=" + contentProperty.toString() + "; mimetype=" + mimetype);
         }
         
-        NodeRef thumbnail = null;
+        if (!permissionService.hasPermission(node, PermissionService.READ_PROPERTIES).equals(AccessStatus.ALLOWED))
+        {
+            throw new AccessDeniedException("Access Denied");
+        }
         
         // Check for duplicate names
         if (thumbnailName != null && getThumbnailByName(node, contentProperty, thumbnailName) != null)
@@ -163,24 +194,40 @@ public class ThumbnailServiceImpl implements ThumbnailService
             throw new ThumbnailException(ERR_DUPLICATE_NAME);
         }
         
-        // Apply the thumbnailed aspect to the node if it doesn't already have it
+        NodeRef thumbnail = AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<NodeRef>()
-        if (this.nodeService.hasAspect(node, ContentModel.ASPECT_THUMBNAILED) == false)
         {
-            this.nodeService.addAspect(node, ContentModel.ASPECT_THUMBNAILED, null);
+            public NodeRef doWork() throws Exception
+            {
+                NodeRef thumbnail;
+                
+                // Apply the thumbnailed aspect to the node if it doesn't already have it
+                if (nodeService.hasAspect(node, ContentModel.ASPECT_THUMBNAILED) == false)
+                {
+                    // Ensure we do not update the 'modifier' due to thumbnail addition
+                    behaviourFilter.disableBehaviour(node, ContentModel.ASPECT_AUDITABLE);
+                    try
+                    {
+                        nodeService.addAspect(node, ContentModel.ASPECT_THUMBNAILED, null);
+                    }
+                    finally
+                    {
+                        behaviourFilter.enableBehaviour(node, ContentModel.ASPECT_AUDITABLE);
+                    }
                 }
                 
                 // Get the name of the thumbnail and add to properties map
-        Map<QName, Serializable> properties = new HashMap<QName, Serializable>(2);
+                String thumbName = thumbnailName;
-        if (thumbnailName == null || thumbnailName.length() == 0)
+                Map<QName, Serializable> properties = new HashMap<QName, Serializable>(4);
+                if (thumbName == null || thumbName.length() == 0)
                 {
-            thumbnailName = GUID.generate();
+                    thumbName = GUID.generate();
                 }
                 else
                 {
-            String thumbnailFileName = generateThumbnailFileName(thumbnailName, mimetype);
+                    String thumbnailFileName = generateThumbnailFileName(thumbName, mimetype);
                     properties.put(ContentModel.PROP_NAME, thumbnailFileName);
                 }
-        properties.put(ContentModel.PROP_THUMBNAIL_NAME, thumbnailName);
+                properties.put(ContentModel.PROP_THUMBNAIL_NAME, thumbName);
                 
                 // Add the name of the content property
                 properties.put(ContentModel.PROP_CONTENT_PROPERTY_NAME, contentProperty);
@@ -189,17 +236,17 @@ public class ThumbnailServiceImpl implements ThumbnailService
                 if (assocDetails == null)
                 {
                     // Create the thumbnail using the thumbnails child association
-            thumbnail = this.nodeService.createNode(
+                    thumbnail = nodeService.createNode(
                             node, 
                             ContentModel.ASSOC_THUMBNAILS,
-                    QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, thumbnailName), 
+                            QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, thumbName), 
                             ContentModel.TYPE_THUMBNAIL, 
                             properties).getChildRef();
                 }
                 else
                 {
                     // Create the thumbnail using the specified parent assoc details
-            thumbnail = this.nodeService.createNode(
+                    thumbnail = nodeService.createNode(
                             assocDetails.getParent(),
                             assocDetails.getAssociationType(),
                             assocDetails.getAssociationName(),
@@ -207,21 +254,21 @@ public class ThumbnailServiceImpl implements ThumbnailService
                             properties).getChildRef();
 
                     // Associate the new thumbnail to the source
-            this.nodeService.addChild(
+                    nodeService.addChild(
                             node, 
                             thumbnail, 
                             ContentModel.ASSOC_THUMBNAILS, 
-                    QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, thumbnailName));
+                            QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, thumbName));
                 }
                 
                 // Get the content reader and writer for content nodes
-        ContentReader reader = this.contentService.getReader(node, contentProperty);
+                ContentReader reader = contentService.getReader(node, contentProperty);
-        ContentWriter writer = this.contentService.getWriter(thumbnail, ContentModel.PROP_CONTENT, true);
+                ContentWriter writer = contentService.getWriter(thumbnail, ContentModel.PROP_CONTENT, true);
                 writer.setMimetype(mimetype);
                 writer.setEncoding(reader.getEncoding());
                 
                 // Catch the failure to create the thumbnail
-        if (this.contentService.isTransformable(reader, writer, transformationOptions) == false)
+                if (contentService.isTransformable(reader, writer, transformationOptions) == false)
                 {
                     if (logger.isDebugEnabled() == true)
                     {
@@ -234,9 +281,13 @@ public class ThumbnailServiceImpl implements ThumbnailService
                 else
                 {
                     // Do the thumbnail transformation
-            this.contentService.transform(reader, writer, transformationOptions);
+                    contentService.transform(reader, writer, transformationOptions);
                 }
                 
+                return thumbnail;
+            }
+        }, AuthenticationUtil.getSystemUserName());
+        
         // Return the created thumbnail
         return thumbnail;
     }
@@ -256,19 +307,28 @@ public class ThumbnailServiceImpl implements ThumbnailService
     /**
      * @see org.alfresco.service.cmr.thumbnail.ThumbnailService#updateThumbnail(org.alfresco.service.cmr.repository.NodeRef, org.alfresco.service.cmr.repository.TransformationOptions)
      */
-    public void updateThumbnail(NodeRef thumbnail, TransformationOptions transformationOptions)
+    public void updateThumbnail(final NodeRef thumbnail, final TransformationOptions transformationOptions)
     {
         if (logger.isDebugEnabled() == true)
         {
             logger.debug("Updating thumbnail (thumbnail=" + thumbnail.toString() + ")");
         }
         
+        if (!permissionService.hasPermission(thumbnail, PermissionService.READ_PROPERTIES).equals(AccessStatus.ALLOWED))
+        {
+            throw new AccessDeniedException("Access Denied");
+        }
+        
+        AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Object>()
+        {
+            public Object doWork() throws Exception
+            {
                 // First check that we are dealing with a thumbnail
-        if (ContentModel.TYPE_THUMBNAIL.equals(this.nodeService.getType(thumbnail)) == true)
+                if (ContentModel.TYPE_THUMBNAIL.equals(nodeService.getType(thumbnail)) == true)
                 {
                     // Get the node that is the source of the thumbnail
                     NodeRef node = null;
-            List<ChildAssociationRef> parents = this.nodeService.getParentAssocs(thumbnail, ContentModel.ASSOC_THUMBNAILS, RegexQNamePattern.MATCH_ALL);
+                    List<ChildAssociationRef> parents = nodeService.getParentAssocs(thumbnail, ContentModel.ASSOC_THUMBNAILS, RegexQNamePattern.MATCH_ALL);
                     if (parents.size() == 0)
                     {
                         if (logger.isDebugEnabled() == true)
@@ -284,11 +344,11 @@ public class ThumbnailServiceImpl implements ThumbnailService
                     }
                     
                     // Get the content property
-            QName contentProperty = (QName)this.nodeService.getProperty(thumbnail, ContentModel.PROP_CONTENT_PROPERTY_NAME);
+                    QName contentProperty = (QName)nodeService.getProperty(thumbnail, ContentModel.PROP_CONTENT_PROPERTY_NAME);
                     
                     // Get the reader and writer            
-            ContentReader reader = this.contentService.getReader(node, contentProperty);
+                    ContentReader reader = contentService.getReader(node, contentProperty);
-            ContentWriter writer = this.contentService.getWriter(thumbnail, ContentModel.PROP_CONTENT, true);
+                    ContentWriter writer = contentService.getWriter(thumbnail, ContentModel.PROP_CONTENT, true);
                     
                     // Set the basic detail of the transformation options
                     transformationOptions.setSourceNodeRef(node);
@@ -297,7 +357,7 @@ public class ThumbnailServiceImpl implements ThumbnailService
                     transformationOptions.setTargetContentProperty(ContentModel.PROP_CONTENT);
                     
                     // Catch the failure to create the thumbnail
-            if (this.contentService.isTransformable(reader, writer, transformationOptions) == false)
+                    if (contentService.isTransformable(reader, writer, transformationOptions) == false)
                     {
                         if (logger.isDebugEnabled() == true)
                         {
@@ -310,7 +370,7 @@ public class ThumbnailServiceImpl implements ThumbnailService
                     else
                     {
                         // Do the thumbnail transformation
-                this.contentService.transform(reader, writer, transformationOptions);
+                        contentService.transform(reader, writer, transformationOptions);
                     }
                 }
                 else
@@ -320,6 +380,9 @@ public class ThumbnailServiceImpl implements ThumbnailService
                         logger.debug("Updating thumbnail: cannot update a thumbnail node that isn't the correct thumbnail type (thumbnail=" + thumbnail.toString() + ")");
                     }
                 }
+                return null;
+            }
+        }, AuthenticationUtil.getSystemUserName());
     }
 
     /**
@@ -341,6 +404,11 @@ public class ThumbnailServiceImpl implements ThumbnailService
             logger.debug("Getting thumbnail by name (nodeRef=" + node.toString() + "; contentProperty=" + contentProperty.toString() + "; thumbnailName=" + thumbnailName + ")");
         }
         
+        if (!permissionService.hasPermission(node, PermissionService.READ_PROPERTIES).equals(AccessStatus.ALLOWED))
+        {
+            throw new AccessDeniedException("Access Denied");
+        }
+        
         // Check that the node has the thumbnailed aspect applied
         if (nodeService.hasAspect(node, ContentModel.ASPECT_THUMBNAILED) == true)
         {
@@ -381,6 +449,11 @@ public class ThumbnailServiceImpl implements ThumbnailService
             logger.debug("Getting thumbnails (nodeRef=" + node.toString() + "; contentProperty=" + contentProperty.toString() + "; mimetype=" + mimetype + ")");
         }
         
+        if (!permissionService.hasPermission(node, PermissionService.READ_PROPERTIES).equals(AccessStatus.ALLOWED))
+        {
+            throw new AccessDeniedException("Access Denied");
+        }
+        
         // Check that the node has the thumbnailed aspect applied
         if (nodeService.hasAspect(node, ContentModel.ASPECT_THUMBNAILED) == true)
         {