[jboss-jira] [JBoss JIRA] Created: (JBPORTAL-1378) Access denied while viewing document in CMSAdmin Portlet
Access denied while viewing document in CMSAdmin Portlet
--------------------------------------------------------
Key: JBPORTAL-1378
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1378
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal CMS
Affects Versions: 2.6.CR1
Environment: Fedora Linux, JBoss 4.0.5.GA, JBoss Portal 2.6.CR1
Reporter: Chunyun Zhao
Assigned To: Sohil Shah
Viewing the document that doesn't have Anonymous READ permission assigned in CMSAdmin
Portlet causes "Access to this resource is denied". I've checked that the
authenticated portal user has the read/write access to the document.
Here is the stack trace:
org.jboss.portal.cms.CMSException: Access to this resource is denied
at
org.jboss.portal.cms.impl.interceptors.ACLInterceptor.invoke(ACLInterceptor.java:257)
at org.jboss.portal.cms.CMSInterceptor.invoke(CMSInterceptor.java:36)
at org.jboss.portal.common.invocation.Invocation.invokeNext(Invocation.java:115)
at org.jboss.portal.common.invocation.Invocation.invoke(Invocation.java:157)
at org.jboss.portal.cms.impl.jcr.JCRCMS.execute(JCRCMS.java:593)
at sun.reflect.GeneratedMethodAccessor1778.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
at org.jboss.mx.interceptor.AbstractInterceptor.invoke(AbstractInterceptor.java:133)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
at
org.jboss.mx.interceptor.ModelMBeanOperationInterceptor.invoke(ModelMBeanOperationInterceptor.java:142)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
at org.jboss.mx.util.JMXInvocationHandler.invoke(JMXInvocationHandler.java:287)
at $Proxy636.execute(Unknown Source)
at
org.jboss.portal.core.cms.servlet.CMSPreviewServlet.doGet(CMSPreviewServlet.java:60)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:697)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at
org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:175)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
My obveration is that the portal security context is not propogated to portal-cms web
application within which CMSPreviewServlet is deployed, and CMSPreviewServlet is trying to
get the file from CMS anonymously.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira