topic Re: Securing Activiti Modeler in Alfresco Archive

Securing Activiti Modeler

balsarori — Mon, 11 Mar 2013 00:37:37 GMT

Currently, Activiti Modeler can be accessed (and models can be modified) without authentication by directly accessing the Modeler, for example:http://localhost:8080/activiti-explorer2/service/editor?id=50Of course, there are different options for administrators to handle this but I think that it sho

Re: Securing Activiti Modeler

jbarrez — Mon, 11 Mar 2013 10:51:10 GMT

Yes, I think that is indeed needed (and we discussed it too already, agreeing we need to add it asap).

Re: Securing Activiti Modeler

balsarori — Tue, 12 Mar 2013 01:34:39 GMT

I'm not sure whats the best way to do this. Anyway, here is what I think can be one option

https://github.com/balsarori/Activiti/commit/4a42468048ac5cd2ec139f519348b62bbab804e2

In this code any call to '/service' will not be allowed unless user was already authenticated (either by Vaadin login form or by Servlet Container). When a user logins to Explorer an attribute is saved in the session (the user id, could be anything else). ExplorerFilter checks for this attribute and will not allow access to '/service' unless this attribute was set or user was authenticated by Servlet Container.

Re: Securing Activiti Modeler

jbarrez — Wed, 13 Mar 2013 08:59:38 GMT

Yes, that makes sense. We'll discuss it shortly, and I have put your link on my notes. Thanks!

Re: Securing Activiti Modeler

mathewjohnston — Wed, 17 Sep 2014 19:08:15 GMT

Can you provide any update? This appears to still be an issue, as of 5.16. In the meantime, is there any way to completely disable modeler (without deploying an SSL decrypting WAF, that is). Unfortunately, I can't deploy Activiti into production with such a severe vulnerability.

EDIT: I notice that JIRA ticket ACT-1970 tracks this, filed at the end of March 2014, but is marked as minor priority. This vulnerability, unless mitigated, would prevent Activiti Explorer's use in any enterprise, so might justify a higher priority.

Thanks!

Re: Securing Activiti Modeler

fionn — Mon, 02 Feb 2015 15:57:08 GMT

Any updates on this issue?
The above fix worked.

Re: Securing Activiti Modeler

jbarrez — Mon, 09 Feb 2015 16:18:02 GMT

Ideally that fix is added to the code. Not sure if it covers all use cases.
A pull request would most certainly be appreciated, if you say you've successfully verified it!

Re: Securing Activiti Modeler

balsarori — Wed, 04 Mar 2015 01:17:06 GMT

I've created a pull request that secures access to /service, process definitions and models should now be accessible to authenticated users only.

https://github.com/Activiti/Activiti/pull/533

Re: Securing Activiti Modeler

b_schnarr — Wed, 04 Mar 2015 07:44:42 GMT

balsarori, thanks. Imho, this is a very important feature and should be merged immediately.