diff --git a/config/alfresco/messages/patch-service.properties b/config/alfresco/messages/patch-service.properties
index e61f33dc0a..3523dbb3e3 100644
--- a/config/alfresco/messages/patch-service.properties
+++ b/config/alfresco/messages/patch-service.properties
@@ -230,4 +230,7 @@ patch.migrateVersionStore.result=Migrated version store. Created {0} version his
patch.inviteEmailTemplate.description=Adds invite email template to invite space
patch.calendarModelNamespacePatch.description=Update the Calendar model namespace URI and reindex all calendar objects.
-patch.calendarModelNamespacePatch.result=Updated the Calendar model namespace URI to http://www.alfresco.org/model/calendar and reindexed {0} calendar objects.
\ No newline at end of file
+patch.calendarModelNamespacePatch.result=Updated the Calendar model namespace URI to http://www.alfresco.org/model/calendar and reindexed {0} calendar objects.
+
+patch.spacesStoreGuestPermission.description=Sets READ permissions for GUEST on root node of the SpacesStore.
+patch.spacesStoreGuestPermission.result=Granted READ permissions for GUEST on root node of the SpacesStore.
diff --git a/config/alfresco/patch/patch-services-context.xml b/config/alfresco/patch/patch-services-context.xml
index e0bac97291..3c48f650e6 100644
--- a/config/alfresco/patch/patch-services-context.xml
+++ b/config/alfresco/patch/patch-services-context.xml
@@ -1410,17 +1410,6 @@
+
+
+
+
diff --git a/config/alfresco/version.properties b/config/alfresco/version.properties
index 30c5b72aaa..aa01ee725f 100644
--- a/config/alfresco/version.properties
+++ b/config/alfresco/version.properties
@@ -19,5 +19,4 @@ version.build=@build-number@
# Schema number
-<<<<<<< .working
-version.schema=133
+version.schema=134
diff --git a/source/java/org/alfresco/repo/admin/patch/impl/SpacesStoreGuestPermissionPatch.java b/source/java/org/alfresco/repo/admin/patch/impl/SpacesStoreGuestPermissionPatch.java
new file mode 100644
index 0000000000..95056c4da5
--- /dev/null
+++ b/source/java/org/alfresco/repo/admin/patch/impl/SpacesStoreGuestPermissionPatch.java
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2005-2007 Alfresco Software Limited.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+ * As a special exception to the terms and conditions of version 2.0 of
+ * the GPL, you may redistribute this Program in connection with Free/Libre
+ * and Open Source Software ("FLOSS") applications as described in Alfresco's
+ * FLOSS exception. You should have recieved a copy of the text describing
+ * the FLOSS exception, and it is also available here:
+ * http://www.alfresco.com/legal/licensing"
+ */
+package org.alfresco.repo.admin.patch.impl;
+
+import java.util.List;
+
+import org.alfresco.i18n.I18NUtil;
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.admin.patch.AbstractPatch;
+import org.alfresco.repo.importer.ImporterBootstrap;
+import org.alfresco.service.cmr.admin.PatchException;
+import org.alfresco.service.cmr.repository.ChildAssociationRef;
+import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.repository.StoreRef;
+import org.alfresco.service.cmr.security.PermissionService;
+import org.alfresco.service.namespace.QName;
+import org.alfresco.service.namespace.RegexQNamePattern;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * Grant Read permission to Guest in SpacesStore root node.
+ * Fix for bug ETWOONE-163.
+ *
+ * [KR] Now correctly applies modified permissions to immediate child nodes of the
+ * root node:
+ *
+ * sys:system - Changed inherit=false, Added GROUP_EVERYONE=READ (to disallow guest)
+ * cm:categoryRoot - Removed guest=READ (as already inherits)
+ *
+ * @author Arseny Kovalchuk
+ * @author kevinr
+ */
+public class SpacesStoreGuestPermissionPatch extends AbstractPatch
+{
+ private static Log logger = LogFactory.getLog(SpacesStoreGuestPermissionPatch.class);
+
+ private static final String MSG_RESULT = "patch.spacesStoreGuestPermission.result";
+
+ private PermissionService permissionService;
+ private ImporterBootstrap importerBootstrap;
+
+
+ public void setPermissionService(PermissionService permissionService)
+ {
+ this.permissionService = permissionService;
+ }
+
+ public void setImporterBootstrap(ImporterBootstrap importerBootstrap)
+ {
+ this.importerBootstrap = importerBootstrap;
+ }
+
+
+ @Override
+ protected String applyInternal() throws Exception
+ {
+ StoreRef store = importerBootstrap.getStoreRef();
+ if (store == null)
+ {
+ throw new PatchException("Bootstrap store has not been set");
+ }
+
+ NodeRef rootRef = nodeService.getRootNode(store);
+ if (logger.isDebugEnabled())
+ {
+ logger.debug("Store Ref:" + store + " NodeRef: " + rootRef);
+ }
+ permissionService.setPermission(
+ rootRef, PermissionService.GUEST_AUTHORITY, PermissionService.READ, true);
+
+ String sysQName = importerBootstrap.getConfiguration().getProperty("system.system_container.childname");
+ String catQName = "cm:categoryRoot";
+ List refs = nodeService.getChildAssocs(
+ rootRef, ContentModel.ASSOC_CHILDREN, RegexQNamePattern.MATCH_ALL);
+ for (ChildAssociationRef ref : refs)
+ {
+ if (ref.getQName().equals(QName.createQName(sysQName, namespaceService)))
+ {
+ // found sys:system node
+ permissionService.setInheritParentPermissions(ref.getChildRef(), false);
+ permissionService.setPermission(
+ ref.getChildRef(), PermissionService.ALL_AUTHORITIES, PermissionService.READ, true);
+ }
+ else if (ref.getQName().equals(QName.createQName(catQName, namespaceService)))
+ {
+ // found cm:categoryRoot node
+ permissionService.clearPermission(ref.getChildRef(), PermissionService.GUEST_AUTHORITY);
+ }
+ }
+
+ return I18NUtil.getMessage(MSG_RESULT);
+ }
+}
\ No newline at end of file