topic Re: Web site workflow - bug? in Alfresco Archive

Web site workflow - bug?

harshad — Mon, 17 Sep 2007 20:35:08 GMT

I am using Alfresco 2.1 community edition with WCM.I am using the web site submission workflow - serial option - ……. to create content. In the workflow I am selecting a user who is Content publisher to review and publish it. This user can see the task and approve it.But it looks like there is a sec

Re: Web site workflow - bug?

davidc — Tue, 18 Sep 2007 12:20:13 GMT

Remove that dashlet via configuration, so it's not available for selection.

Re: Web site workflow - bug?

sacco — Tue, 18 Sep 2007 19:23:58 GMT

I don't really see how this closes the potential security hole, which is server-side, surely?

If it's a hole, then it remains so even if we don't provide a convenient one-click exploit (although it's obviously better no to do this).

Re: Web site workflow - bug?

davidc — Wed, 19 Sep 2007 16:12:17 GMT

Correct - the workflow service has yet to declare its permission requirements.

Re: Web site workflow - bug?

paulossilva — Mon, 15 Oct 2007 14:36:59 GMT

What about to extend permissions to web forms themselves?

I mean, we have some security breaches in web forms in the way that a content contributor, i.e., from HR department could submit a product release web form since she can see all web project forms from her sandbox!

I know that an workflow could prevent that form to be published by some reviewer, however, you would agree that is not the desirable way to deal with it.