Repository navigation
[9.5] fix: restrict unpublished SharePoint Online pages to owners/editors (#3645) (#4437) - #4481
Merged
Merged
Conversation
…3645) (#4437) ## Summary With DLS enabled, unpublished SharePoint Online pages were still returned to users with view access. SharePoint does not update a page's ACLs when it is unpublished, so the connector kept the old view-only permissions on the indexed document. This detects draft vs published state from the page version string and restricts `_allow_access_control` on unpublished pages to owners/editors only. A `published` field is also exposed on `site_page` documents. Closes #3645 ## Changes - Detect published state from `OData__UIVersionString` (major version = published, minor version = draft) - For unpublished pages, restrict ACLs to owners/editors: - unique per-page permissions: only edit-or-higher role members - inherited site permissions: use a site editors ACL set instead of the full site ACL - Add `require_edit_access` to `_get_access_control_from_role_assignment` - Add `EDIT_ITEM_MASK` / `EDIT_ROLE_TYPES` constants - Add `published` field on `site_page` documents - Debug log when an unpublished page ACL is restricted ## Testing - Unit tests: version parsing, edit-only role filtering, unpublished/published ACL behavior (unique + inherited permissions). `209 passed` in `test_sharepoint_online.py`. - E2E: not run locally (requires live SharePoint Online tenant with DLS). ## Notes for reviewers - Published detection defaults to `published=True` when version info is missing, to avoid over-restricting access. - **Merge note with #4396:** both PRs touch `datasource.py` and `test_sharepoint_online.py`. A test merge shows one mechanical conflict in `_get_access_control_from_role_assignment` (this PR adds `require_edit_access`, #4396 adds `site_id`). Tests auto-merge. Resolution is to keep both optional parameters and pass both from `site_pages`. - Consider backport labels if needed. --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
entsearchmachine
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 9.5: