135255 arebegea: MNT-17427 : api/invite/cancel deletes records in the database with a GET: CSRF/XSS attack
- delete the script/org/alfresco/repository/invite/invite.get
- use the alternatives: script/org/alfresco/repository/site/invitation/invitation.post and script/org/alfresco/repository/site/invitation/invitation.delete
- updating the tests
- updating the controller for the invitation.delete to a java controller
- fix test fallout (SiteServiceTest testInviteDisabledUser - expected error status code)
- improve security by allowing only invitationIDs that belong the the site passed as parameter to be canceled
- be consistent and return 404 when an invitationID can not be found
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137384 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134806 mward: Merged mward/repo-1600-zonesfilter (5.2.1) to 5.2.N (5.2.1)
134741 mward: REPO-1600: added support for zone filtering to GET /people/{personId}/groups
Also brought in-line with spec to return an empty list rather than a 404 if the zone is non-existent.
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137365 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134804 mward: Merged mward/repo-1600-zonesfilter (5.2.1) to 5.2.N (5.2.1)
134686 mward: REPO-1600: implemented logical conjunction for where clause
e.g.
isRoot=true AND zones in ('MY.ZONE')
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137363 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134802 mward: Merged mward/repo-1600-zonesfilter (5.2.1) to 5.2.N (5.2.1)
134670 mward: REPO-1600: initial groundwork
Includes impl for path where no isRoot parameter is supplied.
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137361 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134674 cpopa: Merged WEBAPP-API (5.2.1) to 5.2.N (5.2.1)
134665 cpopa: APPSREPO-105 : Add an API to download multiple file/folders as a zip
- test fixes to get rid of unpredictable failures
- fixes after Gavin's OpenAPI spec review
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137351 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134671 cpopa: Merged WEBAPP-API (5.2.1) to 5.2.N (5.2.1)
134630 cpopa: APPSREPO-105 : Add an API to download multiple file/folders as a zip
- Added an API for creating a download, retrieving download info and canceling a download
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137348 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134310 cturlica: REPO-1304: Create a group
- added create group logic; fixed a sorting bug for get groups/group members; updated test framework - post/create action; fix toJSON issue for parentIds and zones.
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137338 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134045 cturlica: REPO-1684: We should not return properties that are empty
- Empty (zero length) string values are considered to be null values, and will be represented the same as null values (i.e. by non-existence of the property).
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137334 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
133613 cturlica: REPO-1743: Bug ? - list groups - orderBy displayName
- made the sort consistent and display the shortName when authorityDisplayName isn't present (same as it's done when sorting by authorityDisplayName)
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@137311 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134766 mmuller: Merged 5.2.N (5.2.1) to 5.2.0 (5.2.0)
134753 mmuller: Merged 5.2.N-REPO-1815 (5.2.1) to 5.2.N (5.2.1)
134749 mmuller: REPO-1815 / ACE-5753 check if operation is null or empty and attach cmisselect=repositoryInfo and some code optimazion
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134987 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
134416 amukha: Merged 5.2.N (5.2.1) to 5.2.0 (5.2.0)
134396 amukha: Merged DEV to 5.2.N (5.2.1)
133903 sglover: MNT-17247 "Disabled user can log into Alfresco Share using external authentication" take user disabled status in to account for external authentication subsystem + tests
133907 sglover: MNT-17247 "Disabled user can log into Alfresco Share using external authentication" don't propagate user disabled exception
133930 sglover: MNT-17247 "Disabled user can log into Alfresco Share using external authentication" move test class and add to a test suite
134295 amukha: MNT-17247: Disabled user can log into Alfresco Share using external authentication
- Added a test to simulate creation of missing person during external auth log in.
134315 amukha: MNT-17247: Disabled user can log into Alfresco Share using external authentication
- Added a fallback to supprt the logging in by non provisioned users.
134354 amukha: MNT-17247: Disabled user can log into Alfresco Share using external authentication
- Added a test with deauthorized user. Refactored existing test to start context once.
134359 jvonka: REPO-1227: External authentication - prevent disabled user from authenticating
- add log warning (with masked username, similar to brute force attack) if authentication bypassed when setting user details
134372 amukha: MNT-17247: Disabled user can log into Alfresco Share using external authentication
- Updated core and data model (contain new logging)
134390 amukha: MNT-17247: Disabled user can log into Alfresco Share using external authentication
- isEnabled flag for users is returned correctly
- Added tests
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134976 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
<< This commit was made for cloud 45. Change made to the wrong brtanch >>
134895 cturlica: Merged 5.2.N (5.2.1) to HEAD (5.2)
134826 cturlica: CLD-3: Trunk broken by Servlet API upgrade on platform
- partial revert of refactoring done in REPO-908
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134896 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
133996 rneamtu: ACE-5416: Merged 5.2.N (5.2.1) to 5.2.0 (5.2.0)
133567 rneamtu: ACE-5639: Comment Activitiy Feed Entries made outside of site show @@NULL@@
- If siteInfo does not exists do not post comment related activity
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134203 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
133966 amorarasu: ACE-5718: Merged 5.2.N (5.2.1) to 5.2.0 (5.2.0)
133954 amorarasu: REPO-1681 / MNT-17228: CMIS: Attempt to delete non-current version throws "Unexpected: current version does not appear ..."
- Fixed the misuse of the version node instead of live node
- Added permission check for deleting a version
- Uncommented the test added by JanV (REPO-1228) + added testcase for deleting with no permission
- PublicApiCallContextHandler inherits basic auth parameters from BasicAuthCallContextHandler, to ensure proper exceptions are thrown by CMIS servlets (in this case, CmisPermissionDeniedException instead of CmisUnauthorizedException).
git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@134200 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
