[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Tom Baeyens commented on JBPM-1958: ----------------------------------- My latest email in the SOA platform mailing list thread on this topic: " the only thing we must prevent from a product standpoint is that clients deploy this in production without them knowing. just like with the jmx-console. there is absolutely NO need to start introducing weird security things. the feature do deploy from designer to runtime engine is targetted for easy development. not for production usage. so we should not be spending effort to build a very complex solution so that a developer can VERY SECURELY deploy a process archive on his own machine :-) that is a waiste of our time. so no security is needed in development. at the same time, an operator is not going to fire up his eclipse to get the latest processes from svn and then deploy then with the designer plugin to the production DB. :-) so the designer deployment feature is not needed in production. so 1) we should offer that functionality out of the box to our developers in the project download. 2) in the product, people do not expose this fnctionality on the internet without them knowing about it. which means that in a default production installation this should be turned off. which is exactly how it is done currently. so i don't think there needs to be anything improved. regards, tom. " since no-one replied, i think we can safely :-) mark this issue as rejected. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Thomas Diesler updated JBPM-1958: --------------------------------- Priority: Major (was: Critical) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Thomas Diesler resolved JBPM-1958. ---------------------------------- Fix Version/s: (was: jBPM 3.2.6 GA ) Resolution: Rejected This has been hacked around in the SOA platform and deployers have been rejected. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Alejandro Guizar reopened JBPM-1958: ------------------------------------ -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Alejandro Guizar reopened JBPM-1958: ------------------------------------ This issue and its counterpart SOA-1065 are about sandboxing the jBPM scripts and action handlers. Securing process deployment was already done by moving the upload servlet into the webapp secure area. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Alejandro Guizar updated JBPM-1958: ----------------------------------- Comment: was deleted -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBPM-1958?page=com.atlassian.jira.plug... ] Alejandro Guizar updated JBPM-1958: ----------------------------------- Assignee: (was: Alejandro Guizar) Unassigning till a viable solution to this problem is devised. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira