Hyland Connect

pcharsle · ‎10-06-2016

We have successfully used the excellent addon Gallery Plus Dashlet | Alfresco Add-ons - Alfresco Customizations in Alfresco 4.1 and are now working to use it in Alfresco 5.1. We have discovered that when the dashlet is installed, the "download zip" feature fails for all users except the Alfresco Administrator. The following error is displayed in the catalina.out log file:

Caused by: org.alfresco.repo.security.permissions.AccessDeniedException: 08200020 Access Denied. You do not have the appropriate permissions to perform this operation.

at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:57)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:166)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.alfresco.repo.transaction.RetryingTransactionInterceptor$1.execute(RetryingTransactionInterceptor.java:86)

at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:464)

at org.alfresco.repo.transaction.RetryingTransactionInterceptor.invoke(RetryingTransactionInterceptor.java:76)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.alfresco.enterprise.repo.authorization.AuthorizationStatusInterceptor.invoke(AuthorizationStatusInterceptor.java:154)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

at com.sun.proxy.$Proxy24.hasAspect(Unknown Source)

at de.fme.alfresco.dashlets.AlbumAspect.onCreateNode(Unknown Source)

Debugging has shown that the error occurs on line 132 of the AlbumAspect class when nodeService.hasAspect(parentNode, GalleryPlusModel.ASPECT_ALBUM) is called. The error still occurs even when parentNode does not have the GalleryPlusModel.ASPECT_ALBUM.

This means that the only way for us to give our users the new download zip functionality is to remove the gallery dashlet completely.

Can anyone suggest why this error might be happening or what further tests we could do to find a solution?

afaust · ‎10-10-2016

OK - as expected the issue is due to the way the DownloadStorage creates the temporary container for the ZIP file preparation. Alfresco in this case are actually not following the best practices they want external developers / customers to follow and do not handle the security / privilege context in a way that would prevent this sort of errors in addons.

There are two ways to deal with this and both require a change in the policy of Gallery Plus. Either the policy changes to use "nodeService" bean instead of "NodeService" and thus circumvents security checks altogether (essentially using the same not-"best practice" approach Alfresco used) or before checking hasAspect performs a check to see if the node actually exists and the current user can access it (which requires the PermissionService).

View answer in original post

afaust · ‎10-07-2016

You might have noticed that the Gallery Plus dashlet was only a hackathon project of a single developer. It is currently not even downloadable anymore via the link provided in addons.alfresco.com. It has not been updated to work with any newer Alfresco version after its initial release. The source code now lives in GItHub. You could file an issue with the developer via that project - maybe he may provide you with an updated version for Alfresco 5.x.

Unfortunately you have cut the stacktrace of the error short - there might have been some valueable information in the remainder of it to determine why this causes an access denied error (the context of the onCreateNode call is very important). I.e. the "Download as ZIP" action may have created a temporary node to construct the ZIP in without applying all the permissions that would allow a user to access that node - that would not be a problem for "Download as a ZIP" which potentially has its own little workaround for handling lack of permissions.

pcharsle · ‎10-09-2016

Hi Axel, Apologies for not including the full stacktrace. It's now included below.

Yes, we are aware that this is an add-on and that the original developer no longer maintains it. However, until Alfresco can improve the out of the box Image Previewer, our users will not allow us to drop the Gallery dashlet. We created our own fork of the Image gallery dashlet here which we have updated to work with Alfresco 5.1 and will create a pull request once we have resolved the problem with "Download as a zip".

2016-10-10 08:55:22,910 INFO [org.jasig.cas.services.DefaultServicesManagerImpl] - <Reloading registered services.>

2016-10-10 08:55:22,911 INFO [org.jasig.cas.services.DefaultServicesManagerImpl] - <Loaded 4 services.>

2016-10-10 08:55:36,340 ERROR [extensions.webscripts.AbstractRuntime] [http-apr-8080-exec-2] Exception from executeScript - redirecting to status template error: 09100015 Wrapped Exception (with status template): 09105123 Access Denied. You do not have the appropriate permissions to perform this operation.

org.springframework.extensions.webscripts.WebScriptException: 09100015 Wrapped Exception (with status template): 09105123 Access Denied. You do not have the appropriate permissions to perform this operation.

at org.springframework.extensions.webscripts.AbstractWebScript.createStatusException(AbstractWebScript.java:1138)

at org.springframework.extensions.webscripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:171)

at org.alfresco.repo.web.scripts.RepositoryContainer$3.execute(RepositoryContainer.java:519)

at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:464)

at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:587)

at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:656)

at org.alfresco.repo.web.scripts.RepositoryContainer.executeScriptInternal(RepositoryContainer.java:428)

at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:308)

at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:382)

at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:210)

at org.springframework.extensions.webscripts.servlet.WebScriptServlet.service(WebScriptServlet.java:132)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.alfresco.repo.web.filter.beans.NullFilter.doFilter(NullFilter.java:75)

at sun.reflect.GeneratedMethodAccessor526.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:132)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

at com.sun.proxy.$Proxy312.doFilter(Unknown Source)

at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.alfresco.web.app.servlet.WebScriptSSOAuthenticationFilter.doFilter(WebScriptSSOAuthenticationFilter.java:121)

at sun.reflect.GeneratedMethodAccessor526.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

at com.sun.proxy.$Proxy312.doFilter(Unknown Source)

at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.alfresco.web.app.servlet.WebscriptCookieAuthenticationFilter.doFilter(WebscriptCookieAuthenticationFilter.java:84)

at sun.reflect.GeneratedMethodAccessor526.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:132)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

at com.sun.proxy.$Proxy312.doFilter(Unknown Source)

at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:89)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:68)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)

at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)

at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1040)

at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2441)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2430)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

Caused by: org.alfresco.repo.security.permissions.AccessDeniedException: 09105123 Access Denied. You do not have the appropriate permissions to perform this operation.