XWiki uses the wrong wiki reference in AuthorizationManager

@@ -30,6 +30,7 @@
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.xwiki.component.annotation.Component;
+import org.xwiki.model.ModelContext;
 import org.xwiki.model.reference.DocumentReference;
 import org.xwiki.model.reference.EntityReference;
 import org.xwiki.model.reference.EntityReferenceSerializer;
@@ -49,6 +50,8 @@
  */
 @Component
 @Singleton
+// The fan-out is of 21 instead of 20 after introducing the ModelContext, not an easy one to refactor.
+@SuppressWarnings("checkstyle:ClassFanOutComplexity")
 public class DefaultAuthorizationManager implements AuthorizationManager
 {
     /**
@@ -83,6 +86,9 @@ public class DefaultAuthorizationManager implements AuthorizationManager
     @Inject
     private DocumentRequiredRightsChecker documentRequiredRightsChecker;
 
+    @Inject
+    private ModelContext modelContext;
+
     /**
      * Check if the user is the super admin.
      *
@@ -156,21 +162,30 @@ private boolean hasSecurityAccess(Right right, DocumentReference userReference,
             return false;
         }
 
-        if ((!right.isReadOnly() && xwikiBridge.isWikiReadOnly())
-            || (userReference == null && xwikiBridge.needsAuthentication(right))) {
+        if (checkWikiPreferencesDiscardAccess(right, userReference, entityReference)) {
             return false;
         }
 
-        // For edit right, check if the user has all required rights.
-        if (right == Right.EDIT && !this.documentRequiredRightsChecker.hasRequiredRights(userReference,
-            entityReference))
-        {
-            logDenyIfCheck(right, userReference, entityReference, check, "misses required right");
+        return evaluateSecurityAccess(right, userReference, entityReference, check);
+    }
 
-            return false;
+    private boolean checkWikiPreferencesDiscardAccess(Right right, DocumentReference userReference,
+        EntityReference entityReference)
+    {
+        if (entityReference != null) {
+            EntityReference currentEntityReference = this.modelContext.getCurrentEntityReference();
+            this.modelContext.setCurrentEntityReference(entityReference);
+
+            try {
+                if ((!right.isReadOnly() && xwikiBridge.isWikiReadOnly())
+                    || (userReference == null && xwikiBridge.needsAuthentication(right))) {
+                    return true;
+                }
+            } finally {
+                this.modelContext.setCurrentEntityReference(currentEntityReference);
+            }
         }
-
-        return evaluateSecurityAccess(right, userReference, entityReference, check);
+        return false;
     }
 
     private void logDenyIfCheck(Right right, DocumentReference userReference, EntityReference entityReference,

@@ -36,6 +36,7 @@
 import org.xwiki.cache.CacheManager;
 import org.xwiki.cache.config.CacheConfiguration;
 import org.xwiki.model.EntityType;
+import org.xwiki.model.ModelContext;
 import org.xwiki.model.internal.DefaultModelConfiguration;
 import org.xwiki.model.internal.reference.DefaultEntityReferenceProvider;
 import org.xwiki.model.internal.reference.DefaultStringEntityReferenceResolver;
@@ -93,6 +94,7 @@
 import static org.junit.jupiter.api.Assertions.fail;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import static org.xwiki.security.authorization.Right.ADMIN;
 import static org.xwiki.security.authorization.Right.COMMENT;
@@ -135,6 +137,9 @@ class DefaultAuthorizationManagerIntegrationTest extends AbstractAuthorizationTe
     @MockComponent
     private UserBridge userBridge;
 
+    @MockComponent
+    private ModelContext modelContext;
+
     /** Mocked securityEntryReader */
     @MockComponent
     private SecurityEntryReader securityEntryReader;
@@ -152,6 +157,8 @@ class DefaultAuthorizationManagerIntegrationTest extends AbstractAuthorizationTe
     /** Factory for security reference */
     private SecurityReferenceFactory securityReferenceFactory;
 
+    private DocumentReference currentEntityReference = new DocumentReference("xwiki", "Page", "Space");
+
     @BeforeComponent
     void initializeMocks() throws Exception
     {
@@ -177,6 +184,7 @@ void setUp() throws Exception
     {
         securityReferenceFactory = componentManager.getInstance(SecurityReferenceFactory.class);
         authorizationManager = componentManager.getInstance(AuthorizationManager.class);
+        when(this.modelContext.getCurrentEntityReference()).thenReturn(currentEntityReference);
     }
 
     /**
@@ -466,7 +474,20 @@ void defaultAccessOnEmptyWikis() throws Exception
         // Any Local user on another subwiki
         assertAccess(null, getUser("a local user", "any SubWiki"),
             getDoc("an another subwiki", "anySpace", "any Other SubWiki"));
+    }
 
+    @Test
+    void verifyNeedsAuthentication() throws Exception
+    {
+        initialiseWikiMock("emptyWikis");
+        when(this.xWikiBridge.needsAuthentication(VIEW)).thenReturn(true);
+        DocumentReference documentReference = getXDoc("an empty main wiki", "anySpace");
+        assertFalse(authorizationManager.hasAccess(VIEW, null, documentReference));
+        verify(this.modelContext).setCurrentEntityReference(documentReference);
+        verify(this.modelContext).setCurrentEntityReference(currentEntityReference);
+
+        when(this.xWikiBridge.needsAuthentication(VIEW)).thenReturn(false);
+        assertTrue(authorizationManager.hasAccess(VIEW, null, documentReference));
     }
 
     @Test