diff --git a/source/java/org/alfresco/repo/web/scripts/bean/ADMRemoteStore.java b/source/java/org/alfresco/repo/web/scripts/bean/ADMRemoteStore.java index 45a4b7cbfe..2fd361d67d 100644 --- a/source/java/org/alfresco/repo/web/scripts/bean/ADMRemoteStore.java +++ b/source/java/org/alfresco/repo/web/scripts/bean/ADMRemoteStore.java @@ -625,33 +625,43 @@ public class ADMRemoteStore extends BaseRemoteStore res.setStatus(Status.STATUS_NOT_FOUND); return; } - - try - { - final NodeRef fileRef = fileInfo.getNodeRef(); - this.nodeService.addAspect(fileRef, ContentModel.ASPECT_TEMPORARY, null); - - // ALF-17729 - NodeRef parentFolderRef = unprotNodeService.getPrimaryParent(fileRef).getParentRef(); - behaviourFilter.disableBehaviour(parentFolderRef, ContentModel.ASPECT_AUDITABLE); - - try - { - this.nodeService.deleteNode(fileRef); - } - finally - { - behaviourFilter.enableBehaviour(parentFolderRef, ContentModel.ASPECT_AUDITABLE); - } - - if (logger.isDebugEnabled()) - logger.debug("deleteDocument: " + fileInfo.toString()); - } - catch (AccessDeniedException ae) - { - res.setStatus(Status.STATUS_UNAUTHORIZED); - throw ae; - } + + final String runAsUser = getPathRunAsUser(path); + AuthenticationUtil.runAs(new RunAsWork() + { + @SuppressWarnings("synthetic-access") + public Void doWork() throws Exception + { + try + { + final NodeRef fileRef = fileInfo.getNodeRef(); + // MNT-16371: Revoke ownership privileges for surf-config folder contents, to tighten access for former SiteManagers. + nodeService.addAspect(fileRef, ContentModel.ASPECT_TEMPORARY, null); + + // ALF-17729 + NodeRef parentFolderRef = unprotNodeService.getPrimaryParent(fileRef).getParentRef(); + behaviourFilter.disableBehaviour(parentFolderRef, ContentModel.ASPECT_AUDITABLE); + + try + { + nodeService.deleteNode(fileRef); + } + finally + { + behaviourFilter.enableBehaviour(parentFolderRef, ContentModel.ASPECT_AUDITABLE); + } + + if (logger.isDebugEnabled()) + logger.debug("deleteDocument: " + fileInfo.toString()); + } + catch (AccessDeniedException ae) + { + res.setStatus(Status.STATUS_UNAUTHORIZED); + throw ae; + } + return null; + } + }, runAsUser); } /**