topic Re: call custom java class from script in Alfresco Archive

call custom java class from script

rhofkens — Tue, 05 Sep 2006 09:33:45 GMT

Hello,I'm trying to call a custom java class from a script. According to the Rhino documentation, this should be possible using something like this:writer = new geoxt.test.dmc.de.Writer();The class is in the classpath. I get the following error:11:28:07,890 ERROR [SpringAwareUserTransaction] Trans

Re: call custom java class from script

kevinr — Tue, 05 Sep 2006 09:55:24 GMT

We have disabled this ability as it effectively creates a huge security hole! Consider the possibility of a user with restricted access to only a single space in the app. They could write a javascript file that contained Java to execute and upload it to their space - they could then execute that file by URL using the script command processor. The Java code could contain anything - including code that could bring down the server, change the users security permissions or open files on the server disk itself - this would be very bad! Unlike the JavaScript API which is of course protected by all the usual Alfresco security and permissions, hand crafted Java code can do anything…

The way to call Java from JavaScript is to code an Alfresco repository action in Java. With Alfresco JavaScript 1.4 it is now possible to call repository actions including custom actions (which is very useful!).
http://wiki.alfresco.com/wiki/Custom_Actions
http://wiki.alfresco.com/wiki/JavaScript_API#Actions_API

Thanks,

Kevin

Re: call custom java class from script

rhofkens — Tue, 05 Sep 2006 10:20:54 GMT

Hi Kevin,

you're completely right about the security implications of course, i hadn't thought about that.

I'll write a custom action instead, the documentation and SDK offer good guidelines on this topic.

Thanks,

roel.