AlfrescoAssignment and email notifications

[marco_altieri]

I have written a custom JBPM workflow that for some tasks has to send notifications to the assigned users.

I know how to do it using a custom java action or a simple javascript, but I am trying to use the flag bpm_sendEMailNotifications: if this flag is true, the class org.alfresco.repo.workflow.jbpm.AlfrescoAssignment automatically sends the notifications.

For example the following task in the workflow definition sets the flag to true on the creation of the task.

    <task-node name="finalReview">
        <task name="mswf:reviewTask">
            <assignment class="org.alfresco.repo.workflow.jbpm.AlfrescoAssignment">
               <pooledactors>#{finalReviewReviewer}</pooledactors>
            </assignment>
            <event type="task-create">
                <script>
                    executionContext.setVariable("bpm_sendEMailNotifications", true);
                </script>
            </event>
        </task>
        <transition name="approve" to="endFinalReview"/>
        <transition name="reject" to="endFinalReview"/>
    </task-node>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The transition to this node fails with the following exception:
"07052361 Accessing task with id='jbpm$200957' is not allowed for user 'atc1'"

atc1 is the user that clicks the transition button and it is not the current user assigned to the task.

The exception is thrown by the class WorkflowNotificationUtils when it tries to get the WorkflowTask (at line 168 for Alfresco enterprise version 4.1.7):

WorkflowTask workflowTask = services.getWorkflowService().getTaskById(taskId);

I verified that the task has been already assigned to a different user, as expected.

[marco_altieri]

It is not possible to replicate the issue with the vanilla workflows because the assignment to the reviewers is executed when the workflow starts.
In this case, the user that sends the notifications is necessarily the user that started the workflow and so there is no problem with permissions.

In my workflow, the review process starts only after the completion of other tasks and the user that activates it is not the same user that started the workflow.
To solve the problem I have modified the AlfrescoAssignment class executing the code to send the notifications as system. I do not think that this will create any security issues if users do not have access to the email notifiication templates and the javascript console.