topic [webscripts & content rules] Security issue with admin in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143698#M100538 <HTML><HEAD></HEAD><BODY><SPAN>I am developing a community site, in which a Single Page Interface performs calls on our alfresco REST webscripts. We are using alfresco as pure storage, in which every user on the community site is a user in alfresco. </SPAN><BR /><BR /><SPAN>One of the things we're implementing is a mail system, so every user has 3 "boxes" in his homespace: Inbox (incoming mail), Outbox (outgoing mail) and Incoming (place where users can "drop" their mails). We have a content rule on the incoming folder, which removes the child from incoming and places the child in the inbox folder. This is a custom script:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>var homespace = space.parent;<BR />if( homespace ){<BR />&nbsp;&nbsp; var inbox = homespace.childByNamePath("Inbox");<BR /><BR />&nbsp;&nbsp; if(inbox){<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; inbox.addNode(document);<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; space.removeNode(document);<BR />&nbsp;&nbsp; }<BR />}<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>The problem we're having, is that when the Administrator user is logged in, everything works. We can send a mail, create a secondary child association in the incoming, and the script moves this association towards the inbox.</SPAN><BR /><BR /><SPAN>However, when the administrator is NOT logged in, the webscript sending the email throws this error:</SPAN><BR /><BR /><BR /><SPAN>500 Description:&nbsp;&nbsp;&nbsp; An error inside the HTTP server which prevented it from fulfilling the request.</SPAN><BR /><SPAN> </SPAN><BR /><SPAN>Message:&nbsp;&nbsp;&nbsp;A valid SecureContext was not provided in the RequestContext</SPAN><BR /><SPAN> </SPAN><BR /><SPAN>Exception:&nbsp;&nbsp;&nbsp;net.sf.acegisecurity.AuthenticationCredentialsNotFoundException - A valid SecureContext was not provided in the RequestContext</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp; </SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:477)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:355)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.audit.AuditComponentImpl.auditImpl(AuditComponentImpl.java:256)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:191)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;$Proxy2.exists(Unknown Source)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleServiceImpl.checkForCopy(RuleServiceImpl.java:976)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleServiceImpl.canExecuteRule(RuleServiceImpl.java:951)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleServiceImpl.executePendingRule(RuleServiceImpl.java:884)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleServiceImpl.executePendingRulesImpl(RuleServiceImpl.java:857)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleServiceImpl.executePendingRules(RuleServiceImpl.java:830)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.rule.RuleTransactionListener.beforeCommit(RuleTransactionListener.java:69)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.transaction.AlfrescoTransactionSupport$TransactionSynchronizationImpl.doBeforeCommit(AlfrescoTransactionSupport.java:631)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.transaction.AlfrescoTransactionSupport$TransactionSynchronizationImpl.doBeforeCommit(AlfrescoTransactionSupport.java:613)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.transaction.AlfrescoTransactionSupport$TransactionSynchronizationImpl.beforeCommit(AlfrescoTransactionSupport.java:591)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.support.TransactionSynchronizationUtils.triggerBeforeCommit(TransactionSynchronizationUtils.java:48)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.support.AbstractPlatformTransactionManager.triggerBeforeCommit(AbstractPlatformTransactionManager.java:821)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:637)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:624)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:307)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.util.transaction.SpringAwareUserTransaction.commit(SpringAwareUserTransaction.java:420)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:242)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:158)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.web.scripts.WebScriptRuntime.executeScript(WebScriptRuntime.java:174)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.alfresco.web.scripts.WebScriptServlet.service(WebScriptServlet.java:106)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;javax.servlet.http.HttpServlet.service(HttpServlet.java:803)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;mypackage.filters.XSLTFilter.doFilter(Unknown Source)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:200)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:773)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:703)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:895)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)</SPAN><BR /><SPAN>&nbsp;&nbsp;&nbsp;java.lang.Thread.run(Unknown Source)</SPAN><BR /><BR /><SPAN>Is this a bug? Bad coding on my part? What to do?</SPAN><BR /><BR /><SPAN>Thanks for reading!</SPAN><BR /><BR /><SPAN>Rogier</SPAN></BODY></HTML> Fri, 23 Nov 2007 11:10:48 GMT rogier_oudshoor 2007-11-23T11:10:48Z [webscripts & content rules] Security issue with admin https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143698#M100538 I am developing a community site, in which a Single Page Interface performs calls on our alfresco REST webscripts. We are using alfresco as pure storage, in which every user on the community site is a user in alfresco. One of the things we're implementing is a mail system, so every user has 3 "boxes Fri, 23 Nov 2007 11:10:48 GMT https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143698#M100538 rogier_oudshoor 2007-11-23T11:10:48Z Re: [webscripts & content rules] Security issue with admin https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143699#M100539 <HTML><HEAD></HEAD><BODY><SPAN>Note that when i mean that the administrator is logged in, i mean that someone is logged in into the Alfresco system via web client on another machine.</SPAN><BR /><BR /><SPAN>The script is run by a regular user account which has coordinator access on the incoming folder, and no access on the inbox.</SPAN></BODY></HTML> Fri, 23 Nov 2007 11:13:08 GMT https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143699#M100539 rogier_oudshoor 2007-11-23T11:13:08Z Re: [webscripts & content rules] Security issue with admin https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143700#M100540 <HTML><HEAD></HEAD><BODY><A href="http://issues.alfresco.com/browse/AR-1936" rel="nofollow noopener noreferrer">http://issues.alfresco.com/browse/AR-1936</A></BODY></HTML> Fri, 14 Dec 2007 10:35:16 GMT https://connect.hyland.com/t5/alfresco-archive/webscripts-content-rules-security-issue-with-admin/m-p/143700#M100540 kevinr 2007-12-14T10:35:16Z