12:11 p.m.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:11 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=comments#action_1235... ]
Thomas Heute commented on JBPORTAL-1239:
----------------------------------------
Mmm, i don't get it.
I just tried to restrict access to the Test page only to the "Admin" role, the
other users don't see the tab as expected.
Could you clarify ?
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:01 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
RU on the alpha2 build or trunk? I tried Admin on the test page to no avail (tried it by
setting overwrite in default_object.xml for the test), then verified it in the DB just to
make sure it was set correctly in JBP_OBJECT_NODE_SEC. No workie!
Will try it with this morning's trunk build and let you know. (Inadvertent fix?)
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:07 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=comments#action_1235... ]
Thomas Heute commented on JBPORTAL-1239:
----------------------------------------
Trunk, but this hasn't changed.
Be careful, the container of the test page, (the default portal) has recursive view
rights. So whatever you set at the page level is overriden by the portal privilege.
You need to remove the default portal recursive view privilege, then grant view privilege
on the default page. If you do this and only this, you won't be able to see the test
page.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:09 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
That seems to be backwards to me, I would expect that the more specific would override the
less specific. But will try it
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:22 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=comments#action_1235... ]
Thomas Heute commented on JBPORTAL-1239:
----------------------------------------
Not when you *grant* access.
You cannot remove access, so that's the only way (with this interface, that is very
close to the underlying API)
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Julien Viet
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:24 a.m.
New subject: [JBoss JIRA] Assigned: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Thomas Heute reassigned JBPORTAL-1239:
--------------------------------------
Assignee: Thomas Heute (was: Julien Viet)
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:17 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
Ok, I think I am in the right place:
server/default/deploy/jboss-portal.sar/conf/data/default-object.xml
Here is the original:
<deployments>
<deployment>
<parent-ref/>
<if-exists>keep</if-exists>
<portal>
<portal-name>default</portal-name>
<properties>
<!--
| Set the layout for the default portal, see also portal-layouts.xml.
-->
<property>
<name>layout.id</name>
<value>generic</value>
</property>
<!--
| Set the theme for the default portal, see also portal-themes.xml.
-->
<property>
<name>theme.id</name>
<value>renaissance</value>
</property>
<!--
| Set the default render set name (used by the render tag in layouts), see
also portal-renderSet.xml
-->
<property>
<name>theme.renderSetId</name>
<value>divRenderer</value>
</property>
<!--
| Set the default strategy name (used by the strategy interceptor), see also
portal-strategies.xml
-->
<property>
<name>layout.strategyId</name>
<value>maximizedRegion</value>
</property>
<!--
| The default page name, if the property is not explicited then the default
page name is "default"
-->
<property>
<name>portal.defaultObjectName</name>
<value>default</value>
</property>
</properties>
<supported-modes>
<mode>view</mode>
<mode>edit</mode>
<mode>help</mode>
</supported-modes>
<supported-window-states>
<window-state>normal</window-state>
<window-state>minimized</window-state>
<window-state>maximized</window-state>
</supported-window-states>
<page>
<page-name>default</page-name>
<properties>
<property>
<name>order</name>
<value>1</value>
</property>
</properties>
<window>
<window-name>JSPPortletWindow</window-name>
<instance-ref>JSPPortletInstance</instance-ref>
<region>left</region>
<height>0</height>
</window>
<window>
<window-name>CMSWindow</window-name>
<content>
<content-type>cms</content-type>
<content-uri>/default/index.html</content-uri>
</content>
<region>center</region>
<height>0</height>
</window>
<window>
<window-name>UserPortletWindow</window-name>
<instance-ref>UserPortletInstance</instance-ref>
<region>left</region>
<height>1</height>
</window>
</page>
<security-constraint>
<policy-permission>
<unchecked/>
<action-name>viewrecursive</action-name>
<action-name>personalizerecursive</action-name>
</policy-permission>
</security-constraint>
</portal>
</deployment>
I am assuming the preceding security entry is the view recursive permission that needs to
be removed
I took the security-constraint element, moved it up into the end of the page element
before it, removed personalizerecursive and changed viewrecursive to simply be view.
Is this correct? Anyway, it doesn't work for me on Alpha 2.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:19 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
I also changed the setting to overwrite
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:05 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
Ok, I had to do this to get it to work:
<security-constraint>
<policy-permission>
<unchecked/>
<action-name>view</action-name>
</policy-permission>
</security-constraint>
</page>
<security-constraint>
<policy-permission>
<unchecked/>
<action-name>view</action-name>
<action-name>personalizerecursive</action-name>
</policy-permission>
</security-constraint>
</portal>
Is this correct? view on the portal then view on the default page within the portal,
personalizerecursive will be set on anything within the portal
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:05 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
If so this one can be closed out, Thanks.
I just have to turn my assumptions on security on their head then it all makes some sense
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:28 p.m.
New subject: [JBoss JIRA] Resolved: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Thomas Heute resolved JBPORTAL-1239.
------------------------------------
Fix Version/s: 2.6.Beta1
Resolution: Rejected
Yes this is correct :)
Everything is closed then you open doors from top of the tree to the bottom.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:06 p.m.
New subject: [JBoss JIRA] Reopened: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom reopened JBPORTAL-1239:
---------------------------------------
This is broken on 2.6cr1 it was also broken on the beta version. Security on the
navigation tree isn't being honored. I can see nav tabs I have no permissions on
Also, can you document how to create a navigation system? The one you have is really
marginal at best. Look at https://jsftab.dev.java.net/, that is a nice one, really
simple, supports roles, nested tabs (sorry, doesn't work for portals, it uses jsf
actions but it is KISS and well designed)
I really think pages/window stuff in object.xml should be separated from the navigation
tree.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Alpha2
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:08 p.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom updated JBPORTAL-1239:
--------------------------------------
Affects Version/s: 2.6.CR1
2.6.Beta1
(was: 2.6.Alpha2)
broken again
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.CR1, 2.6.Beta1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:19 a.m.
New subject: [JBoss JIRA] Resolved: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Thomas Heute resolved JBPORTAL-1239.
------------------------------------
Resolution: Done
As said in the forum It has been fixed.
I tried again just to make sure in CR 1.
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.CR1, 2.6.Beta1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:50 a.m.
New subject: [JBoss JIRA] Reopened: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Stephen Westbom reopened JBPORTAL-1239:
---------------------------------------
I am unable to get it to work. I use only view, not view recursive at the top level page,
I used a role setting for a different page at the top level nav and it still shows. Can
you change the samples to reflect security settings so that I have a working model to
use?
Also, a suggestion, document how the navigation region works so we can replace it or
modify it to work the way we want it to. This is view code and we need to control it.
Thanks
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.CR1, 2.6.Beta1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=comments#action_1236... ]
Thomas Heute commented on JBPORTAL-1239:
----------------------------------------
What i did to test:
Changed the default portal level from view-recursive to view (only) for users of the
unchecked role.
Change the default page of the default portal to view (only) for users of the unchecked
role.
Test and News pages won't get displayed in the tabs. (since i didn't add a view
authorization).
PS: The other remark has nothing to do in Jira, please use the forums. By the way i have
this in the pipe already (Writing doco on how to change the header tabs and links).
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.CR1, 2.6.Beta1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:52 a.m.
New subject: [JBoss JIRA] Commented: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=comments#action_1236... ]
Stephen Westbom commented on JBPORTAL-1239:
-------------------------------------------
The default permissions on the default portal level seem to be view recursive. Once I
added in the view permission at the default portal level it did the right thing. Can you
create a sequence diagram for the navigation system and document the pieces?
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.CR1, 2.6.Beta1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:10 a.m.
New subject: [JBoss JIRA] Updated: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Julien Viet updated JBPORTAL-1239:
----------------------------------
Fix Version/s: 2.6.CR2
(was: 2.6.Beta1)
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Beta1, 2.6.CR1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.CR2
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:14 a.m.
New subject: [JBoss JIRA] Resolved: (JBPORTAL-1239) page level security not honored in the navigation system
[ http://jira.jboss.com/jira/browse/JBPORTAL-1239?page=all ]
Thomas Heute resolved JBPORTAL-1239.
------------------------------------
Fix Version/s: 2.6.Beta1
(was: 2.6.CR2)
Resolution: Done
As i said, it was fixed, thanks for not reponening again this case !
page level security not honored in the navigation system
--------------------------------------------------------
Key: JBPORTAL-1239
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1239
Project: JBoss Portal
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Portal Security
Affects Versions: 2.6.Beta1, 2.6.CR1
Environment: Windows XP
Reporter: Stephen Westbom
Assigned To: Thomas Heute
Fix For: 2.6.Beta1
In 2.4 sp1 pages are checked for security before being displayed as a tab in the
navigation using this jsp:
jboss-portal.sar\portal-core.war\WEB-INF\jsp\catalog\index.jsp
This seems to be handled by the psib request parameter (a map). In 2.4 the map only gives
you PortalNodeURLs that you have permissions on, in all the 2.6 versions you get all the
siblingURLs (your term in the JSP page) regardless of the permission settings in the
{project name}_object.xml
Can this be fixed so that the psib parameter only gives you a handle to a map that gives
you objects you have permissions to see?
Thanks
Stephen
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7025
days inactive
7104
days old
19 comments
4 participants
participants (4)
-
Julien Viet (JIRA) -
Stephen Westbom (JIRA) -
Stephen Westbom (JIRA)
-
Thomas Heute (JIRA)