problem of linking a javascript to a webscript

[seraphon]

Hi

I ve wanted to put a copy of the files used for the new myspace webscript in the Alfresco space webscripts extension so that I could do some customisation to those files while keeping the originals untouched.
I though that the myspace webscript was a good start to see how to do a custom GUI for Alfresco.
So I ve created the subspaces org/alfresco/sample/test in webscripts extension and I put the following files in it
myspaces2.get.desc.xml
myspaces2.get.html.ftl
myspaces2.js
myspaces_preview_panel2.ftl
myspacespanel2.get.desc.xml
myspacespanel2.get.html.ftl
myspaces-webscript2.jsp
After updating in these files the new file's names I did the update webscript service and thus I got 42 webscript detected.

When I went to http://localhost:8080/alfresco/wcs/sample/myspaces2

I got the page myspaces but without the icons for the spaces or content.
I think it must be because I ve put a wrong path in myspaces2.get.html.ftl in order to integrate myspaces2.js

<script type="text/javascript" src="/org/alfresco/sample/test/myspaces2.js"></script>‍

Can someone please tell me what I should put? I ve tried a lot of different path but I seem to misunderstand something
Any help would be appreciated
Regards Seraphon

[mikeh]

There are two authentication methods - web client and HTTP BASIC.

BASIC authentication is useful for REST-based services as you can supply the authentication credentials in the intial HTTP request headers, which is widely supported by various clients.

Web client authentication is when you go through the Alfresco login screen and get a jsession id.

If your new drag-and-drop portlet is designed to sit within the web client, when you should address it using the /alfresco/wcservice/… URL root. This will use web client authentication.


Mike

[seraphon]

I do understand that there are 2 authentication needed.
but what I d like is to only have to go through one of them, the login of Alfresco.
The login of Alfresco is necessary because it changes depending on the user for reason of rights.
But the BASIC authentication is the same for all users.
The REST-based service I call in my template only need the right to read a javascript file located in Alfresco's repository.

So what I wanted is to put the login and password for the REST-based service in my template so that when a user logs for the first time then go on the myspaces customed portlet, he wont have to enter a login and password.

the ticket=${session.ticket} solution didnt work for me

Cant I do something that looks like

/alfresco/service/api/path/content/workspace/SpacesStore/Company%20Home/myspaces.js  user=reader&password=reader‍

?

Regards
Seraphon

[mikeh]

…but what I d like is to only have to go through one of them, the login of Alfresco.

Cant I do something that looks like

/alfresco/service/api/path/content/workspace/SpacesStore/Company%20Home/myspaces.js  user=reader&password=reader‍

Yes, but as I said above, you need to use a slightly different URL:

/alfresco/wcservice/api/path/content/workspace/SpacesStore/Company%20Home/myspaces.js‍

Note the wcservice part, drop the user and pass parameters

Mike

[seraphon]

Many thanks it works
but I have some question from a security point of view.
From the few test I ve done, in a web browser you need to enter a BASIC authentication only once. After the first log in all users can use the myspaces portlet.
Now my question is, is there a way for a user to recover the login and password used in the BASIC authentication?
because there may be the possibilities that a user uses a post and enter his Alfresco authentification, so the first BASIC authentication will take on that user loggin and password. Now if a second user go on the same posts and web browser and he has less permission than the first one, can he somehow recover the BASIC authentication loggin and password previously used?

I know it is unlikely but security isnt my domain so I d rather know your opinion on the matter and sorry if that was a stupid question.

Regards
Seraphon

[mikeh]

As long as your users logout and the browser isn't set to remember passswords, then there's no problem.

Thanks,
Mike