[JBoss JIRA] Created: (GTNPORTAL-1450) Priority for skin modules
by Patrice Lamarque (JIRA)
Priority for skin modules
-------------------------
Key: GTNPORTAL-1450
URL: https://jira.jboss.org/browse/GTNPORTAL-1450
Project: GateIn Portal
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: User Interface
Affects Versions: 3.1.0-GA
Reporter: Patrice Lamarque
The css stylesheets declared in gatein-resources.xml files get merged in no specific order.
Sometimes, it is useful to control the order in which the resulting css markup appears in the merged file in order to apply css overrides.
This is typically the kind of things you would like to do in an extension.
By implementing a priority on skin module we should be able to give more control to the overrides.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (GTNPORTAL-1008) Gadget permissions are not working correctly (gagdet with restricted access in the AppReg are visible)
by Tugdual Grall (JIRA)
Gadget permissions are not working correctly (gagdet with restricted access in the AppReg are visible)
------------------------------------------------------------------------------------------------------
Key: GTNPORTAL-1008
URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1008
Project: GateIn Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Security
Affects Versions: 3.0.0-GA
Reporter: Tugdual Grall
When in the App registry a gadget as been set to visible only to a restricted audience this permission is not used when in the portlet/gadget catalog.
Use case:
1- Connect as Root
2- Go in the App Registry
3- Select one gadget, for example ToDo
4- Set the permission to /platform/administrators usrs
5- log out
6- connect as mary/gtn
7- go to your dashboard
8- click add gadget:
9 - BUG: you can see the ToDo Gadget and you can add it to the page ( You are not supposed to)
10 - Edit your page
11- Click on Gadget:
12- BUG: you can see the ToDo gadget (same bug as before)
13-BUG Add it on the page, you can drop it but it wil not be visible (protected content) since you are not allowed to do it.
FIX: we need to hide the gadget from the catalog when the permissions are set.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (GTNPORTAL-1965) Private gadget's category is visible to all users in dashboard
by William Siqueira (JIRA)
Private gadget's category is visible to all users in dashboard
--------------------------------------------------------------
Key: GTNPORTAL-1965
URL: https://issues.jboss.org/browse/GTNPORTAL-1965
Project: GateIn Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Security, User Interface
Affects Versions: 3.1.0-GA
Environment: RHEL 6.0
Firefox/3.6.18
Reporter: William Siqueira
Priority: Critical
Attachments: CategoryGadgetBug.pdf
I would like to a gadget category to be visible only to Administrators. In this category I'll add some gadgets, but it should not be visible to other users than Administrators.
The problem is when I go to my dashboard logged as another user that is not in Administrator group, I still can see the category that should be visible only to Administrators.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (GTNPORTAL-2073) XSS encoding in UIFormTextAreaInput.java
by Honza Fnukal (JIRA)
XSS encoding in UIFormTextAreaInput.java
----------------------------------------
Key: GTNPORTAL-2073
URL: https://issues.jboss.org/browse/GTNPORTAL-2073
Project: GateIn Portal
Issue Type: Enhancement
Security Level: Public (Everyone can see)
Reporter: Honza Fnukal
Fight place where to encode value is when rendering as this is UI component responsibility.
This component is used by many others, and some pass value encoded, some not.
Eg:
In UIGadgetEditor is this method and it encodes value, this cause double encoding:
public void processRender(WebuiRequestContext context) throws Exception
{
UIFormTextAreaInput uiInputSource = getUIFormTextAreaInput(FIELD_SOURCE);
UIFormStringInput uiInputName = getUIStringInput(FIELD_NAME);
String encoded = StringEscapeUtils.escapeHtml(StringEscapeUtils.unescapeHtml(uiInputSource.getValue()));
uiInputSource.setValue(encoded);
if(this.isEdit()) { uiInputName.setEditable(false); }
super.processRender(context);
}
There is probably more code like this, I thin the best is clean it up here.
Unfortunately it is probably in SP in similar way too. If we disable encoding in UIFormTextAreaInput, it will fix double encoding, but enable XSS where it is not encoded.
This task track such places and remove encoding from other places.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months
[JBoss JIRA] Created: (GTNPORTAL-1926) DB and LDAP in read-only: user attributes are saved only to DB but they are still read from LDAP
by Marek Posolda (JIRA)
DB and LDAP in read-only: user attributes are saved only to DB but they are still read from LDAP
------------------------------------------------------------------------------------------------
Key: GTNPORTAL-1926
URL: https://issues.jboss.org/browse/GTNPORTAL-1926
Project: GateIn Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Identity integration
Affects Versions: 3.1.0-GA
Environment: - EPP 5.1.1.DEV01 with latest exo.portal.component.identity from GateIn trunk
- Picketlink 1.3.0.Alpha03
- LDAP configured with read-only setup (picketlink-idm-ldap-acme-config.xml from "example" folder used as configuration file)
Reporter: Marek Posolda
Assignee: Boleslaw Dawidowicz
Fix For: 3.2.0-GA
I have LDAP configured as read-only (Parameter "readOnly" with value "true" is configured as option in configuration of "PortalRepository" in picketlink configuration file picketlink-idm-ldap-acme-config.xml )
And then I am doing this in EPP UI:
1) Login as "mposolda" with password
2) Click to my name in right top corner
3) Change my first name and last name to "Marekkk Poosoldaaaa".
4) Click "Save" and I have message that attributes are changed successfully
5) Logout
6) Login again as mposolda
7) I am seeing that I am still "Marek Posolda"
Problem is that attributes are written to DB in method FallbackIdentityStoreImpl.updateAttributes (which is correct) but then they are read from LDAP in FallbackIdentityStoreImpl.getAttributes and DB attributes are simply ignored . This is confusing for users, because they may have feeling that their attributes are updated but they aren't)
I think that one of these two conditions should be met:
a) Show warning in step 4 that user can't change LDAP attributes (like FirstName, Lastname or Email)
b) Don't show warning but in this case, attributes from DB should have preference over attributes from LDAP.
It will be nice if this can be configurable and administrator can choose between option (a) or (b)
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 6 months