[ https://jira.jboss.org/jira/browse/GPD-278?page=com.atlassian.jira.plugin... ] Thomas Diesler commented on GPD-278: ------------------------------------ Please have look at the IntegrationTestHelper. It demonstrates how to obtain a MBeanServerConnection and deployes a file through the MainDeployer -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/GPD-278?page=com.atlassian.jira.plugin... ] Ronald van Kuijk commented on GPD-278: -------------------------------------- As I mentioned in SOA-1065, this is for me totallty unrelated (but if someone can prove otherwise, I'd be happy to change my point of view). Changing the deployer so drastically shoud (imo) go into GPD 4 and not a micro/patch release. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/GPD-278?page=com.atlassian.jira.plugin... ] Thomas Diesler updated GPD-278: ------------------------------- Fix Version/s: jBPM jPDL Designer 3.1.7 Priority: Critical (was: Major) This is a critical issue that must get addressed in 3.1.7 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/GPD-278?page=com.atlassian.jira.plugin... ] Koen Aers commented on GPD-278: ------------------------------- As Len Dimaggio states in his closing comment of SOA-265 (not for everyone) : Summary: For standalone server, default configuration exposes /upload servlet For embedded server, all configuration exposes /upload servlet For embedded server, production configuration does not expose /up;load servlet jBPM User guide inlcudes instructions to expose or not expose /upload servlet Standalone and embedded server .zip files both inlcude /tools/resources dir with these files: -rw-r--r-- 1 ldimaggi ldimaggi 723723 Feb 3 16:25 jbpm-console-development.war -rw-r--r-- 1 ldimaggi ldimaggi 723724 Feb 3 16:25 jbpm-console-production.war This solution IMO closes the security hole at the expense of two different artefacts. It has nothing to do with the way processes are deployed to the server (ie servlet vs other system). It is only a matter of making sure that the deployment happens by a person with the right credentials. The only way to solve this properly is by making the install script ask to create a userid/password combo with deployment privileges, by securing the servlet and by making a preference in the gpd to configure this userid/password combo. We need to keep in mind that our first goal (of the jBPM project) is to reach out to as many possible users as possible on as many platforms as possible. Therefore, we need to hold on to a smooth out-of-the-box experience. I don't agree that this issue is critical for the next GPD release and I even think it shouldn't be fixed for now given the existing solution (though not ideal) in the SOA product. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/GPD-278?page=com.atlassian.jira.plugin... ] Koen Aers resolved GPD-278. --------------------------- Resolution: Rejected As can be derived from the comments, this issue has nothing to do with the GPD. A sandbox system for the runtime is being put in place. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira