Dashlet permissions error

[rockshore]

I've got a non-administrator user who is able to view their 'My Favorites' by navigating to Repository > My Favorites.

However, if they then attempt to view them in the My Documents Dashlet on the Dashboard, they get a static 'Loading…' message. Clicking Favorites then invokes the following output:

03180024 Wrapped Exception (with status template): 03181166 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js': 03181165 Access Denied. You do not have the appropriate permissions to perform this operation.‍

I've replicated the issue and this is what I get when I tail the Catalina.out log file:

15:54:57,923  ERROR [extensions.webscripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 03180024 Wrapped Exception (with status template): 03181166 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js': 03181165 Access Denied.  You do not have the appropriate permissions to perform this operation.
org.springframework.extensions.webscripts.WebScriptException: 03180024 Wrapped Exception (with status template): 03181166 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js': 03181165 Access Denied.  You do not have the appropriate permissions to perform this operation.
   at org.springframework.extensions.webscripts.AbstractWebScript.createStatusException(AbstractWebScript.java:758)
   at org.springframework.extensions.webscripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:171)
   at org.alfresco.repo.web.scripts.RepositoryContainer$2.execute(RepositoryContainer.java:377)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:381)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:436)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:466)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:304)
   at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:333)
   at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:189)
   at org.springframework.extensions.webscripts.servlet.WebScriptServlet.service(WebScriptServlet.java:118)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:58)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:558)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:852)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
   at java.lang.Thread.run(Thread.java:619)
Caused by: org.alfresco.scripts.ScriptException: 03181166 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js': 03181165 Access Denied.  You do not have the appropriate permissions to perform this operation.
   at org.alfresco.repo.jscript.RhinoScriptProcessor.execute(RhinoScriptProcessor.java:194)
   at org.alfresco.repo.processor.ScriptServiceImpl.executeScript(ScriptServiceImpl.java:282)
   at org.alfresco.repo.web.scripts.RepositoryScriptProcessor.executeScript(RepositoryScriptProcessor.java:102)
   at org.springframework.extensions.webscripts.AbstractWebScript.executeScript(AbstractWebScript.java:981)
   at org.springframework.extensions.webscripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:86)
   … 25 more
Caused by: org.alfresco.repo.security.permissions.AccessDeniedException: 03181165 Access Denied.  You do not have the appropriate permissions to perform this operation.
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:48)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.audit.AuditMethodInterceptor.proceedWithAudit(AuditMethodInterceptor.java:217)
   at org.alfresco.repo.audit.AuditMethodInterceptor.proceed(AuditMethodInterceptor.java:184)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:137)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy53.getAllSetPermissions(Unknown Source)
   at org.alfresco.repo.site.SiteServiceImpl.getSiteVisibility(SiteServiceImpl.java:852)
   at org.alfresco.repo.site.SiteServiceImpl.createSiteInfo(SiteServiceImpl.java:823)
   at org.alfresco.repo.site.SiteServiceImpl.getSiteImpl(SiteServiceImpl.java:913)
   at org.alfresco.repo.site.SiteServiceImpl.getSite(SiteServiceImpl.java:894)
   at org.alfresco.repo.site.script.ScriptSiteService.getSite(ScriptSiteService.java:184)
   at sun.reflect.GeneratedMethodAccessor969.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:155)
   at org.mozilla.javascript.NativeJavaMethod.call(NativeJavaMethod.java:243)
   at org.mozilla.javascript.optimizer.OptRuntime.call1(OptRuntime.java:66)
   at org.mozilla.javascript.gen.c7._c9(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js:639)
   at org.mozilla.javascript.gen.c7.call(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.mozilla.javascript.optimizer.OptRuntime.call1(OptRuntime.java:66)
   at org.mozilla.javascript.gen.c7._c11(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js:741)
   at org.mozilla.javascript.gen.c7.call(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.mozilla.javascript.optimizer.OptRuntime.call2(OptRuntime.java:76)
   at org.mozilla.javascript.gen.c7._c16(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js:1104)
   at org.mozilla.javascript.gen.c7.call(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.mozilla.javascript.optimizer.OptRuntime.callName0(OptRuntime.java:108)
   at org.mozilla.javascript.gen.c7._c0(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js:1198)
   at org.mozilla.javascript.gen.c7.call(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.mozilla.javascript.ContextFactory.doTopCall(ContextFactory.java:393)
   at org.mozilla.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:2834)
   at org.mozilla.javascript.gen.c7.call(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.mozilla.javascript.gen.c7.exec(file:/opt/alfresco/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js)
   at org.alfresco.repo.jscript.RhinoScriptProcessor.executeScriptImpl(RhinoScriptProcessor.java:472)
   at org.alfresco.repo.jscript.RhinoScriptProcessor.execute(RhinoScriptProcessor.java:190)
   … 29 more
Caused by: net.sf.acegisecurity.AccessDeniedException: Access is denied.
   at net.sf.acegisecurity.vote.AffirmativeBased.decide(AffirmativeBased.java:86)
   at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:394)
   at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:44)
   … 66 more‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

When I add the user to ALFRESCO_ADMINISTRATORS, the documents can be viewed from the Dashboard, so it must be a permissions issue.

All I could think to do was to make sure the EVERYONE group was a Consumer of the Data Dictionary, but this doesn't seem to have made the slightest bit of difference.

Can anyone please suggest where I might be going wrong and how this could be fixed? Apologies in advance, but Java exception stacks aren't my forté!

Thanks in advance.

[mikeh]

Could they have favourited a document that lives within a Site whose permission was changed from public to private (or it was private/moderated) and the user has since been removed from the SIte..?

Thanks,
Mike

[rockshore]

Hi Mike,

I have a group called 'Staff' that is setup as the Coordinator of the Site, and all staff members are in this group by way of sub-groups.

i.e. This user is in the Project Manager sub-group in the Staff group.

Also, I have 'EVERYBODY' setup as a Consumer of the Site and all permissions cascade down to child folders within the site.

Thanks for your help.

[rockshore]

This can now be considered fixed.

I applied Coordinator rights to the EVERYBODY group on the top-level site and the error disappeared.

If I want to lock down any folders beneath, I will simply remove inherited permissions and apply a bespoke user group.

However, it does seem rather odd that having the EVERYBODY group setup as a Consumer of the documents/folders in question would allow them to be viewed from the My Favorites [sic] section, but not from the Dashboard My Documents dashlet > Favorites.

Perhaps this disparity could be addressed in coming versions of Alfresco? I'm not entirely sure whether this is a bug or just a feature request, so any advice to forward on would be useful.

Thanks again for your input.

[rockshore]

Hi,

This has reared its ugly head once again since I had to remove 'EVERYONE' permissions from the main repository.

Unless you're a member of the built-in Administrators, you get the following error when attempting to view favourite documents via the dashboard dashlet.

07220026 Wrapped Exception (with status template): 07220775 Failed to execute script 'classpath*:alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/doclist.get.js': 07220774 Access Denied. You do not have the appropriate permissions to perform this operation.‍

Could this be related to the following bug?

http://issues.alfresco.com/jira/browse/ALF-6374

The document in question is otherwise available to everyone in the Staff group I created for the main repository, even as favourite accessed via 'My Favorites'.

I've also seen a similar issue elsewhere within these forums:

http://forums.alfresco.com/en/viewtopic.php?t=16818

But the solution isn't applicable to our setup as everything resides on the same server.

Please can someone advise?