in src/main/java/org/apache/sling/jcr/resourcesecurity/impl/ResourceAccessGateFactory.java [188:190]
public GateResult canOrderChildren(Resource resource) {
return this.checkPermission(resource.getResourceResolver(), resource.getPath(), Session.ACTION_SET_PROPERTY);
}