[maven-release-plugin][skip ci] prepare release 13.8

ACS-3316 Fix custom models downloading and XSS (#1304 ) (#1320 )
* Revert "Revert "ACS-3316 Fix HTML sanitisation bypass (#1266)" (#1294)" This reverts commit 6c407b1ef5. * ACS-3316 Set node name for download node * ACS-3316 Update license Co-authored-by: Damian.Ujma@hyland.com <Damian.Ujma@hyland.com> (cherry picked from commit cc3f8aaff4)
2025-09-10 14:11:58 +00:00 · 2022-08-22 11:07:43 +00:00 · 2022-08-22 12:07:30 +02:00 · 2022-07-28 21:29:53 +00:00 · 2022-07-28 21:29:50 +00:00 · 2022-07-28 14:09:18 -06:00
41 changed files with 481 additions and 156 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -151,10 +151,10 @@ jobs:
        - docker run -d -p 61616:61616 -p 5672:5672 alfresco/alfresco-activemq:5.16.1
      script: travis_wait 20 mvn -B test -pl repository -Dtest=AllDBTestsTestSuite -Ddb.name=alfresco -Ddb.url=jdbc:mariadb://localhost:3307/alfresco?useUnicode=yes\&characterEncoding=UTF-8 -Ddb.username=alfresco -Ddb.password=alfresco -Ddb.driver=org.mariadb.jdbc.Driver

-    - name: "Repository - MySQL 5.7.23 tests"
+    - name: "Repository - MySQL 5.7.28 tests"
      if: (branch =~ /(release\/.*$|master)/ AND commit_message !~ /\[skip db\]/ AND type != pull_request) OR commit_message =~ /\[db\]/
      before_script:
-        - docker run -d -p 3307:3306 -e MYSQL_ROOT_PASSWORD=alfresco -e MYSQL_USER=alfresco -e MYSQL_DATABASE=alfresco -e MYSQL_PASSWORD=alfresco  mysql:5.7.23 --transaction-isolation='READ-COMMITTED'
+        - docker run -d -p 3307:3306 -e MYSQL_ROOT_PASSWORD=alfresco -e MYSQL_USER=alfresco -e MYSQL_DATABASE=alfresco -e MYSQL_PASSWORD=alfresco  mysql:5.7.28 --transaction-isolation='READ-COMMITTED'
        - docker run -d -p 61616:61616 -p 5672:5672 alfresco/alfresco-activemq:5.16.1
      script: travis_wait 20 mvn -B test -pl repository -Dtest=AllDBTestsTestSuite -Ddb.driver=com.mysql.jdbc.Driver -Ddb.name=alfresco -Ddb.url=jdbc:mysql://localhost:3307/alfresco -Ddb.username=alfresco -Ddb.password=alfresco

--- a/amps/ags/pom.xml
+++ b/amps/ags/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>

   <modules>
--- a/amps/ags/rm-automation/pom.xml
+++ b/amps/ags/rm-automation/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>

   <modules>
--- a/amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml
+++ b/amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>


--- a/amps/ags/rm-community/pom.xml
+++ b/amps/ags/rm-community/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>

   <modules>
--- a/amps/ags/rm-community/rm-community-repo/pom.xml
+++ b/amps/ags/rm-community/rm-community-repo/pom.xml
@@ -8,7 +8,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>

   <properties>
--- a/amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml
+++ b/amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <build>
--- a/amps/pom.xml
+++ b/amps/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <modules>
--- a/amps/share-services/pom.xml
+++ b/amps/share-services/pom.xml
@@ -8,7 +8,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <properties>
--- a/amps/share-services/src/test/java/org/alfresco/slingshot/web/scripts/SlingshotContentGetTest.java
+++ b/amps/share-services/src/test/java/org/alfresco/slingshot/web/scripts/SlingshotContentGetTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005 - 2020 Alfresco Software Limited.
+ * Copyright 2005 - 2022 Alfresco Software Limited.
 *
 * This file is part of the Alfresco software.
 * If the software was purchased under a paid Alfresco license, the terms of the paid license agreement will prevail.
@@ -40,6 +40,7 @@ import org.json.JSONObject;
 import org.junit.Assert;
 import org.springframework.extensions.webscripts.TestWebScriptServer;
 import org.springframework.extensions.webscripts.TestWebScriptServer.GetRequest;
+import org.springframework.extensions.webscripts.TestWebScriptServer.Response;

 import java.io.Serializable;
 import java.util.ArrayList;
@@ -194,13 +195,13 @@ public class SlingshotContentGetTest extends BaseWebScriptTest

        NodeRef rootFolder = createNode(companyHome, "rootFolder", ContentModel.TYPE_FOLDER);

-        NodeRef doc1 = createNodeWithTextContent(rootFolder, "doc1", ContentModel.TYPE_CONTENT, "doc1 file content");
+        NodeRef doc1 = createNodeWithTextContent(rootFolder, "doc1", ContentModel.TYPE_CONTENT, "doc1 file content", MimetypeMap.MIMETYPE_TEXT_PLAIN);

        NodeRef folderX = createNode(rootFolder, "X", ContentModel.TYPE_FOLDER);
        NodeRef folderY = createNode(folderX, "Y", ContentModel.TYPE_FOLDER);
        NodeRef folderZ = createNode(folderY, "Z", ContentModel.TYPE_FOLDER);

-        NodeRef doc2 = createNodeWithTextContent(folderZ, "doc2", ContentModel.TYPE_CONTENT, "doc2 file content");
+        NodeRef doc2 = createNodeWithTextContent(folderZ, "doc2", ContentModel.TYPE_CONTENT, "doc2 file content", MimetypeMap.MIMETYPE_TEXT_PLAIN);

        // uri with relative path at the end
        String uri = URL_CONTENT_DOWNLOAD + doc1.getId() + "/X/Y/Z/doc2";
@@ -212,7 +213,50 @@ public class SlingshotContentGetTest extends BaseWebScriptTest
        nodeService.deleteNode(rootFolder);
    }

-    public NodeRef createNodeWithTextContent(NodeRef parentNode, String nodeCmName, QName nodeType, String content)
+    public void testForcedAttachment() throws Exception
+    {
+        Repository repositoryHelper = (Repository) getServer().getApplicationContext().getBean("repositoryHelper");
+        NodeRef companyHome = repositoryHelper.getCompanyHome();
+
+        NodeRef rootFolder = createNode(companyHome, "rootFolder", ContentModel.TYPE_FOLDER);
+        NodeRef testhtml = createNodeWithTextContent(rootFolder, "testhtml", ContentModel.TYPE_CONTENT, "testhtml content", MimetypeMap.MIMETYPE_HTML);
+        NodeRef testpdf = createNodeWithTextContent(rootFolder, "testpdf", ContentModel.TYPE_CONTENT, "testpdf content", MimetypeMap.MIMETYPE_PDF);
+
+        String uri = URL_CONTENT_DOWNLOAD + testhtml.getId() + "?a=false";
+        GetRequest req = new GetRequest(uri);
+        Response res = sendRequest(req, 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testhtml.getId();
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testhtml.getId() + "?a=true";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId() + "?a=false";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertNull(res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId();
+        res = sendRequest(new GetRequest(uri), 200);
+        assertNull(res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId() + "?a=true";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+
+        nodeService.deleteNode(rootFolder);
+    }
+
+    public NodeRef createNodeWithTextContent(NodeRef parentNode, String nodeCmName, QName nodeType, String content, String mimetype)
    {
        NodeRef nodeRef = createNode(parentNode, nodeCmName, nodeType);

@@ -220,7 +264,7 @@ public class SlingshotContentGetTest extends BaseWebScriptTest
        if (content != null)
        {
            ContentWriter writer = contentService.getWriter(nodeRef, ContentModel.PROP_CONTENT, true);
-            writer.setMimetype(MimetypeMap.MIMETYPE_TEXT_PLAIN);
+            writer.setMimetype(mimetype);
            writer.setEncoding("UTF-8");
            writer.putContent(content);
        }
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-community-repo</artifactId>
-      <version>13.2</version>
+      <version>13.8</version>
   </parent>

   <dependencies>
--- a/data-model/pom.xml
+++ b/data-model/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <properties>
--- a/data-model/src/main/java/org/alfresco/repo/content/ContentStore.java
+++ b/data-model/src/main/java/org/alfresco/repo/content/ContentStore.java
@@ -269,9 +269,25 @@ public interface ContentStore
     * @return A direct access {@code URL} object for the content
     * @throws UnsupportedOperationException if the store is unable to provide the information
     */
+    @Deprecated
    default DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName)
    {
-        return requestContentDirectUrl(contentUrl, attachment, fileName, null);
+        return requestContentDirectUrl(contentUrl, attachment, fileName, null, null);
+    }
+
+    /**
+     * Gets a presigned URL to directly access the content. It is up to the actual store
+     * implementation if it can fulfil this request with an expiry time or not.
+     *
+     * @param contentUrl A content store {@code URL}
+     * @param attachment {@code true} if an attachment URL is requested, {@code false} for an embedded {@code URL}.
+     * @param fileName File name of the content
+     * @return A direct access {@code URL} object for the content
+     * @throws UnsupportedOperationException if the store is unable to provide the information
+     */
+    default DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, String mimetype)
+    {
+        return requestContentDirectUrl(contentUrl, attachment, fileName, mimetype, null);
    }

    /**
@@ -285,7 +301,25 @@ public interface ContentStore
     * @return A direct access {@code URL} object for the content.
     * @throws UnsupportedOperationException if the store is unable to provide the information
     */
+    @Deprecated
    default DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, Long validFor)
+    {
+        return requestContentDirectUrl(contentUrl, attachment, fileName, null, validFor);
+    }
+
+    /**
+     * Gets a presigned URL to directly access the content. It is up to the actual store
+     * implementation if it can fulfil this request with an expiry time or not.
+     *
+     * @param contentUrl A content store {@code URL}
+     * @param attachment {@code true} if an attachment URL is requested, {@code false} for an embedded {@code URL}.
+     * @param fileName File name of the content
+     * @param mimetype Mimetype of the content
+     * @param validFor The time at which the direct access {@code URL} will expire.
+     * @return A direct access {@code URL} object for the content.
+     * @throws UnsupportedOperationException if the store is unable to provide the information
+     */
+    default DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, String mimetype, Long validFor)
    {
        throw new UnsupportedOperationException(
                "Retrieving direct access URLs is not supported by this content store.");
--- a/packaging/distribution/pom.xml
+++ b/packaging/distribution/pom.xml
@@ -9,6 +9,6 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>
 </project>
--- a/packaging/docker-alfresco/pom.xml
+++ b/packaging/docker-alfresco/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <properties>
--- a/packaging/pom.xml
+++ b/packaging/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <modules>
--- a/packaging/tests/pom.xml
+++ b/packaging/tests/pom.xml
@@ -6,7 +6,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <modules>
--- a/packaging/tests/tas-cmis/pom.xml
+++ b/packaging/tests/tas-cmis/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-email/pom.xml
+++ b/packaging/tests/tas-email/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-integration/pom.xml
+++ b/packaging/tests/tas-integration/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-restapi/pom.xml
+++ b/packaging/tests/tas-restapi/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-webdav/pom.xml
+++ b/packaging/tests/tas-webdav/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <developers>
--- a/packaging/war/pom.xml
+++ b/packaging/war/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <properties>
--- a/pom.xml
+++ b/pom.xml
@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <artifactId>alfresco-community-repo</artifactId>
-    <version>13.2</version> 
+    <version>13.8</version>
    <packaging>pom</packaging>
    <name>Alfresco Community Repo Parent</name>

@@ -55,13 +55,13 @@
        <dependency.alfresco-greenmail.version>6.2</dependency.alfresco-greenmail.version>
        <dependency.acs-event-model.version>0.0.13</dependency.acs-event-model.version>

-        <dependency.spring.version>5.3.9</dependency.spring.version>
+        <dependency.spring.version>5.3.18</dependency.spring.version>
        <dependency.antlr.version>3.5.2</dependency.antlr.version>
        <dependency.jackson.version>2.12.3</dependency.jackson.version>
        <dependency.jackson-databind.version>2.12.4</dependency.jackson-databind.version>
        <dependency.cxf.version>3.4.4</dependency.cxf.version>
        <dependency.opencmis.version>1.0.0</dependency.opencmis.version>
-        <dependency.webscripts.version>8.27</dependency.webscripts.version>
+        <dependency.webscripts.version>8.29</dependency.webscripts.version>
        <dependency.bouncycastle.version>1.69</dependency.bouncycastle.version>
        <dependency.mockito-core.version>3.11.2</dependency.mockito-core.version>
        <dependency.mockito-all.version>1.10.19</dependency.mockito-all.version>
@@ -143,7 +143,7 @@
        <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
        <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
        <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>13.2</tag>
+        <tag>13.8</tag>
    </scm>

    <distributionManagement>
--- a/remote-api/pom.xml
+++ b/remote-api/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <dependencies>
--- a/remote-api/src/main/java/org/alfresco/repo/web/scripts/MimeTypeUtil.java
+++ b/remote-api/src/main/java/org/alfresco/repo/web/scripts/MimeTypeUtil.java
@@ -0,0 +1,64 @@
+/*
+ * #%L
+ * Alfresco Remote API
+ * %%
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.web.scripts;
+
+import org.alfresco.repo.content.MimetypeMap;
+import org.alfresco.service.cmr.repository.ContentReader;
+import org.alfresco.service.cmr.repository.MimetypeService;
+import org.springframework.extensions.webscripts.WebScriptRequest;
+
+public class MimeTypeUtil
+{
+
+    /**
+     * Get the file mimetype from the file ContentReader, and if its null then set the mimetype to binary by default
+     * and try to get the correct one from file extension
+     *
+     *
+     * @param reader            reader of the file in the request
+     * @param req               request relating to the file
+     * @param mimetypeService   MimetypeService
+     *
+     * @return  mimetype of the file as a string
+     */
+    public static String determineMimetype(ContentReader reader, WebScriptRequest req, MimetypeService mimetypeService)
+    {
+        String mimetype = reader.getMimetype();
+        if (mimetype == null || mimetype.length() == 0)
+        {
+            String extensionPath = req.getExtensionPath();
+            mimetype = MimetypeMap.MIMETYPE_BINARY;
+            int extIndex = extensionPath.lastIndexOf('.');
+            if (extIndex != -1)
+            {
+                String ext = extensionPath.substring(extIndex + 1);
+                mimetype = mimetypeService.getMimetype(ext);
+            }
+        }
+        return mimetype;
+    }
+
+}
--- a/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentGet.java
+++ b/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentGet.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Remote API
 * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software. 
 * If the software was purchased under a paid Alfresco license, the terms of 
@@ -26,14 +26,18 @@
 package org.alfresco.repo.web.scripts.content;

 import java.io.IOException;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;

 import javax.servlet.ServletContext;
 import javax.servlet.http.HttpServletResponse;

 import org.alfresco.model.ContentModel;
+import org.alfresco.repo.web.scripts.MimeTypeUtil;
 import org.alfresco.service.cmr.dictionary.DictionaryService;
+import org.alfresco.service.cmr.repository.ContentReader;
 import org.alfresco.service.cmr.repository.ContentService;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.namespace.NamespaceService;
@@ -65,6 +69,19 @@ public class ContentGet extends StreamContent implements ServletContextAware
    private NamespaceService namespaceService;
    private ContentService contentService;

+    private List<String> nonAttachContentTypes = Collections.emptyList();
+
+    /**
+     * @param nonAttachContentTypes List<String>
+     */
+    public void setNonAttachContentTypes(List<String> nonAttachContentTypes)
+    {
+        if (nonAttachContentTypes != null && !nonAttachContentTypes.isEmpty())
+        {
+            this.nonAttachContentTypes = nonAttachContentTypes;
+        }
+    }
+
    /**
     * @param servletContext ServletContext
     */
@@ -121,9 +138,7 @@ public class ContentGet extends StreamContent implements ServletContextAware
        {
            throw new WebScriptException(HttpServletResponse.SC_NOT_FOUND, "Unable to find " + reference.toString());
        }
-        
-        // determine attachment
-        boolean attach = Boolean.valueOf(req.getParameter("a"));
+
        
        // render content
        QName propertyQName = ContentModel.PROP_CONTENT;
@@ -140,6 +155,19 @@ public class ContentGet extends StreamContent implements ServletContextAware
                propertyQName = QName.createQName(propertyName, namespaceService);
            }
        }
+        // determine attachment and force download for specific mimetypes - see PRODSEC-5862
+        boolean attach = Boolean.valueOf(req.getParameter("a"));
+        ContentReader reader = contentService.getReader(nodeRef, propertyQName);
+        String mimetype = MimeTypeUtil.determineMimetype(reader, req, mimetypeService);
+
+        if (!attach)
+        {
+            if (nonAttachContentTypes == null || !nonAttachContentTypes.contains(mimetype))
+            {
+                attach = true;
+                logger.warn("Ignored a=false for " + nodeRef.getId() + " since " + mimetype + " is not in the whitelist for non-attach content types");
+            }
+        }

        // Stream the content
        streamContentLocal(req, res, nodeRef, attach, propertyQName, null);
--- a/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentInfo.java
+++ b/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentInfo.java
@@ -1,28 +1,28 @@
-/*
- * #%L
- * Alfresco Remote API
- * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
- * %%
- * This file is part of the Alfresco software. 
- * If the software was purchased under a paid Alfresco license, the terms of 
- * the paid license agreement will prevail.  Otherwise, the software is 
- * provided under the following open source license terms:
- * 
- * Alfresco is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- * 
- * Alfresco is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
- * #L%
- */
+/*
+ * #%L
+ * Alfresco Remote API
+ * %%
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software. 
+ * If the software was purchased under a paid Alfresco license, the terms of 
+ * the paid license agreement will prevail.  Otherwise, the software is 
+ * provided under the following open source license terms:
+ * 
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
 package org.alfresco.repo.web.scripts.content;

 import java.io.IOException;
@@ -33,7 +33,7 @@ import java.util.Map;
 import javax.servlet.http.HttpServletResponse;

 import org.alfresco.model.ContentModel;
-import org.alfresco.repo.content.MimetypeMap;
+import org.alfresco.repo.web.scripts.MimeTypeUtil;
 import org.alfresco.service.cmr.repository.ContentReader;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.namespace.QName;
@@ -79,18 +79,7 @@ public class ContentInfo extends StreamContent
        delegate.setAttachment(req, res, attach, attachFileName);

        // establish mimetype
-        String mimetype = reader.getMimetype();
-        String extensionPath = req.getExtensionPath();
-        if (mimetype == null || mimetype.length() == 0)
-        {
-            mimetype = MimetypeMap.MIMETYPE_BINARY;
-            int extIndex = extensionPath.lastIndexOf('.');
-            if (extIndex != -1)
-            {
-                String ext = extensionPath.substring(extIndex + 1);
-                mimetype = mimetypeService.getMimetype(ext);
-            }
-        }
+        String mimetype = MimeTypeUtil.determineMimetype(reader, req, mimetypeService);

        // set mimetype for the content and the character encoding + length for the stream
        res.setContentType(mimetype);
--- a/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentStreamer.java
+++ b/remote-api/src/main/java/org/alfresco/repo/web/scripts/content/ContentStreamer.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Remote API
 * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software. 
 * If the software was purchased under a paid Alfresco license, the terms of 
@@ -41,6 +41,7 @@ import javax.servlet.http.HttpServletResponse;
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.content.MimetypeMap;
 import org.alfresco.repo.content.filestore.FileContentReader;
+import org.alfresco.repo.web.scripts.MimeTypeUtil;
 import org.alfresco.sync.repo.events.EventPublisher;
 import org.alfresco.repo.web.util.HttpRangeProcessor;
 import org.alfresco.rest.framework.resource.content.CacheDirective;
@@ -359,18 +360,7 @@ public class ContentStreamer implements ResourceLoaderAware
        setAttachment(req, res, attach, attachFileName);
    
        // establish mimetype
-        String mimetype = reader.getMimetype();
-        String extensionPath = req.getExtensionPath();
-        if (mimetype == null || mimetype.length() == 0)
-        {
-            mimetype = MimetypeMap.MIMETYPE_BINARY;
-            int extIndex = extensionPath.lastIndexOf('.');
-            if (extIndex != -1)
-            {
-                String ext = extensionPath.substring(extIndex + 1);
-                mimetype = mimetypeService.getMimetype(ext);
-            }
-        }
+        String mimetype = MimeTypeUtil.determineMimetype(reader, req, mimetypeService);
        
        res.setHeader(HEADER_ACCEPT_RANGES, "bytes");
        try
--- a/remote-api/src/main/java/org/alfresco/rest/api/impl/CustomModelsImpl.java
+++ b/remote-api/src/main/java/org/alfresco/rest/api/impl/CustomModelsImpl.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Remote API
 * %%
- * Copyright (C) 2005 - 2021 Alfresco Software Limited
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software. 
 * If the software was purchased under a paid Alfresco license, the terms of 
@@ -713,6 +713,7 @@ public class CustomModelsImpl implements CustomModels
        try
        {
            NodeRef nodeRef = customModelService.createDownloadNode(modelName, withForm);
+            nodeService.setProperty(nodeRef, ContentModel.PROP_NAME, modelName + DownloadsImpl.DEFAULT_ARCHIVE_EXTENSION);
            return new CustomModelDownload(nodeRef);
        }
        catch (Exception ex)
--- a/remote-api/src/main/resources/alfresco/web-scripts-application-context.xml
+++ b/remote-api/src/main/resources/alfresco/web-scripts-application-context.xml
@@ -249,6 +249,7 @@
      <property name="delegate" ref="webscript.content.streamer" />
      <property name="contentService" ref="contentService" />
      <property name="repository" ref="repositoryHelper" />
+      <property name="nonAttachContentTypes" value="#{T(java.util.Arrays).asList('${content.nonAttach.mimetypes}')}" />
   </bean>
   
   <!--  Content Info -->
--- a/remote-api/src/test/java/org/alfresco/repo/web/scripts/content/ContentGetTest.java
+++ b/remote-api/src/test/java/org/alfresco/repo/web/scripts/content/ContentGetTest.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Share Services AMP
 * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2022 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software. 
 * If the software was purchased under a paid Alfresco license, the terms of 
@@ -66,13 +66,17 @@ public class ContentGetTest extends BaseWebScriptTest
    {
        super.setUp();

-        this.authenticationService = (MutableAuthenticationService) getServer().getApplicationContext()
-                .getBean("AuthenticationService");
+        this.authenticationService = (MutableAuthenticationService)getServer().getApplicationContext().getBean("AuthenticationService");
        this.personService = (PersonService) getServer().getApplicationContext().getBean("PersonService");
        this.nodeService = (NodeService) getServer().getApplicationContext().getBean("NodeService");
        this.contentService = (ContentService) getServer().getApplicationContext().getBean("ContentService");
        AuthenticationUtil.setAdminUserAsFullyAuthenticatedUser();
        createUser(USER_ONE);
+
+        Repository repositoryHelper = (Repository) getServer().getApplicationContext().getBean("repositoryHelper");
+        NodeRef companyHome = repositoryHelper.getCompanyHome();
+
+        rootFolder = createNode(companyHome, "rootFolder", ContentModel.TYPE_FOLDER);
    }

    private void createUser(String userName)
@@ -117,18 +121,13 @@ public class ContentGetTest extends BaseWebScriptTest
     */
    public void testRelativePath() throws Exception
    {
-        Repository repositoryHelper = (Repository) getServer().getApplicationContext().getBean("repositoryHelper");
-        NodeRef companyHome = repositoryHelper.getCompanyHome();
-
-        rootFolder = createNode(companyHome, "rootFolder", ContentModel.TYPE_FOLDER);
-
-        NodeRef doc1 = createNodeWithTextContent(rootFolder, "doc1", ContentModel.TYPE_CONTENT, "doc1 file content");
+        NodeRef doc1 = createNodeWithTextContent(rootFolder, "doc1", ContentModel.TYPE_CONTENT, "doc1 file content", MimetypeMap.MIMETYPE_TEXT_PLAIN);

        NodeRef folderX = createNode(rootFolder, "X", ContentModel.TYPE_FOLDER);
        NodeRef folderY = createNode(folderX, "Y", ContentModel.TYPE_FOLDER);
        NodeRef folderZ = createNode(folderY, "Z", ContentModel.TYPE_FOLDER);

-        NodeRef doc2 = createNodeWithTextContent(folderZ, "doc2", ContentModel.TYPE_CONTENT, "doc2 file content");
+        NodeRef doc2 = createNodeWithTextContent(folderZ, "doc2", ContentModel.TYPE_CONTENT, "doc2 file content", MimetypeMap.MIMETYPE_TEXT_PLAIN);

        // uri with relative path at the end
        String uri = URL_CONTENT_DOWNLOAD + doc1.getId() + "/X/Y/Z/doc2";
@@ -138,7 +137,46 @@ public class ContentGetTest extends BaseWebScriptTest
        Assert.assertEquals("doc2 file content", resp.getContentAsString());
    }

-    public NodeRef createNodeWithTextContent(NodeRef parentNode, String nodeCmName, QName nodeType, String content)
+
+
+    public void testForcedAttachment() throws Exception
+    {
+        NodeRef testhtml = createNodeWithTextContent(rootFolder, "testhtml", ContentModel.TYPE_CONTENT, "testhtml content", MimetypeMap.MIMETYPE_HTML);
+        NodeRef testpdf = createNodeWithTextContent(rootFolder, "testpdf", ContentModel.TYPE_CONTENT, "testpdf content", MimetypeMap.MIMETYPE_PDF);
+
+        String uri = URL_CONTENT_DOWNLOAD + testhtml.getId() + "?a=false";
+        GetRequest req = new GetRequest(uri);
+        Response res = sendRequest(req, 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testhtml.getId();
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testhtml.getId() + "?a=true";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_HTML + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId() + "?a=false";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertNull(res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId();
+        res = sendRequest(new GetRequest(uri), 200);
+        assertNull(res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+
+        uri = URL_CONTENT_DOWNLOAD + testpdf.getId() + "?a=true";
+        res = sendRequest(new GetRequest(uri), 200);
+        assertEquals("attachment", res.getHeader("Content-Disposition"));
+        assertEquals(MimetypeMap.MIMETYPE_PDF + ";charset=UTF-8", res.getContentType());
+    }
+
+    public NodeRef createNodeWithTextContent(NodeRef parentNode, String nodeCmName, QName nodeType, String content, String mimetype)
    {
        NodeRef nodeRef = createNode(parentNode, nodeCmName, nodeType);

@@ -146,7 +184,7 @@ public class ContentGetTest extends BaseWebScriptTest
        if (content != null)
        {
            ContentWriter writer = contentService.getWriter(nodeRef, ContentModel.PROP_CONTENT, true);
-            writer.setMimetype(MimetypeMap.MIMETYPE_TEXT_PLAIN);
+            writer.setMimetype(mimetype);
            writer.setEncoding("UTF-8");
            writer.putContent(content);
        }
--- a/repository/pom.xml
+++ b/repository/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>13.2</version>
+        <version>13.8</version>
    </parent>

    <dependencies>
@@ -245,7 +245,7 @@
        <dependency>
            <groupId>org.freemarker</groupId>
            <artifactId>freemarker</artifactId>
-            <version>2.3.20-alfresco-patched-20200421</version>
+            <version>2.3.20-alfresco-patched-20220413</version>
        </dependency>
        <dependency>
            <groupId>org.apache.xmlbeans</groupId>
--- a/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java
+++ b/repository/src/main/java/org/alfresco/repo/content/ContentServiceImpl.java
@@ -617,7 +617,7 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa
                throw new IllegalArgumentException("The supplied nodeRef " + nodeRef + " has no content.");
            }

-            contentDirectUrlEnabled = (store.isContentDirectUrlEnabled(getContentUrl(nodeRef)));
+            contentDirectUrlEnabled = (store.isContentDirectUrlEnabled(contentData.getContentUrl()));
        }

        return contentDirectUrlEnabled;
@@ -652,7 +652,7 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa
        {
            try
            {
-                directAccessUrl = store.requestContentDirectUrl(contentUrl, attachment, fileName, validFor);
+                directAccessUrl = store.requestContentDirectUrl(contentUrl, attachment, fileName, contentMimetype, validFor);
            }
            catch (UnsupportedOperationException ex)
            {
@@ -662,19 +662,6 @@ public class ContentServiceImpl implements ContentService, ApplicationContextAwa
        return directAccessUrl;
    }

-    protected String getContentUrl(NodeRef nodeRef)
-    {
-        ContentData contentData = getContentData(nodeRef, ContentModel.PROP_CONTENT);
-
-        // check that the URL is available
-        if (contentData == null || contentData.getContentUrl() == null)
-        {
-            throw new IllegalArgumentException("The supplied nodeRef " + nodeRef + " has no content.");
-        }
-
-        return contentData.getContentUrl();
-    }
-
    protected String getFileName(NodeRef nodeRef)
    {
        String fileName = null;
--- a/repository/src/main/java/org/alfresco/repo/content/caching/CachingContentStore.java
+++ b/repository/src/main/java/org/alfresco/repo/content/caching/CachingContentStore.java
@@ -509,4 +509,12 @@ public class CachingContentStore implements ContentStore, ApplicationEventPublis
    {
        return backingStore.requestContentDirectUrl(contentUrl, attachment, fileName, validFor);
    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, String mimeType, Long validFor)
+    {
+        return backingStore.requestContentDirectUrl(contentUrl, attachment, fileName, mimeType, validFor);
+    }
 }
--- a/repository/src/main/java/org/alfresco/repo/content/replication/AggregatingContentStore.java
+++ b/repository/src/main/java/org/alfresco/repo/content/replication/AggregatingContentStore.java
@@ -317,7 +317,7 @@ public class AggregatingContentStore extends AbstractContentStore
        return isContentDirectUrlEnabled;
    }

-    public DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, Long validFor)
+    public DirectAccessUrl requestContentDirectUrl(String contentUrl, boolean attachment, String fileName, String mimetype, Long validFor)
    {
        if (primaryStore == null)
        {
@@ -337,7 +337,7 @@ public class AggregatingContentStore extends AbstractContentStore
            // Check the primary store
            try
            {
-                directAccessUrl = primaryStore.requestContentDirectUrl(contentUrl, attachment, fileName, validFor);
+                directAccessUrl = primaryStore.requestContentDirectUrl(contentUrl, attachment, fileName, mimetype, validFor);
            }
            catch (UnsupportedOperationException e)
            {
@@ -360,7 +360,7 @@ public class AggregatingContentStore extends AbstractContentStore
            {
                try
                {
-                    directAccessUrl = store.requestContentDirectUrl(contentUrl, attachment, fileName, validFor);
+                    directAccessUrl = store.requestContentDirectUrl(contentUrl, attachment, fileName, mimetype, validFor);
                }
                catch (UnsupportedOperationException e)
                {
--- a/repository/src/main/java/org/alfresco/repo/domain/contentdata/AbstractContentDataDAOImpl.java
+++ b/repository/src/main/java/org/alfresco/repo/domain/contentdata/AbstractContentDataDAOImpl.java
@@ -352,13 +352,20 @@ public abstract class AbstractContentDataDAOImpl implements ContentDataDAO
        }

        /**
-         * Looks the node up based on the NodeRef of the given node
+         * Looks the entity up based on the ContentURL of the given node
         */
        @Override
        public Pair<Long, ContentUrlEntity> findByValue(ContentUrlEntity entity)
        {
            String contentUrl = entity.getContentUrl();
            ContentUrlEntity ret = getContentUrlEntity(contentUrl);
+            // Validate if this entity has exactly the value we are looking for or if it is a CRC collision
+            if (ret != null && !entity.getContentUrl().equals(ret.getContentUrl()))
+            {
+                throw new IllegalArgumentException("Collision detected for this contentURL. '" + entity.getContentUrl()
+                        + "' collides with existing contentURL '" + ret.getContentUrl() + "'. (ContentUrlShort;ContentUrlCrc) pair collision: ('"
+                        + entity.getContentUrlShort() + "';'" + entity.getContentUrlCrc() + "')");
+            }
            return (ret != null ? new Pair<Long, ContentUrlEntity>(ret.getId(), ret) : null);
        }

--- a/repository/src/test/java/org/alfresco/repo/content/ContentServiceImplUnitTest.java
+++ b/repository/src/test/java/org/alfresco/repo/content/ContentServiceImplUnitTest.java
@@ -83,6 +83,7 @@ public class ContentServiceImplUnitTest
        openMocks(this);
        when(mockNodeService.getProperty(NODE_REF, ContentModel.PROP_CONTENT)).thenReturn(mockContentData);
        when(mockContentData.getContentUrl()).thenReturn("someContentUrl");
+        when(mockContentData.getMimetype()).thenReturn("someMimetype");
        when(mockNodeService.getProperty(NODE_REF, ContentModel.PROP_NAME)).thenReturn("someFilename");
    }

@@ -133,7 +134,7 @@ public class ContentServiceImplUnitTest

        DirectAccessUrl directAccessUrl = contentService.requestContentDirectUrl(NODE_REF, true, 20L);
        assertNull(directAccessUrl);
-        verify(mockContentStore, never()).requestContentDirectUrl(anyString(), eq(true), anyString(), anyLong());
+        verify(mockContentStore, never()).requestContentDirectUrl(anyString(), eq(true), anyString(), anyString(), anyLong());
    }

    @Test
@@ -144,7 +145,7 @@ public class ContentServiceImplUnitTest

        DirectAccessUrl directAccessUrl = contentService.requestContentDirectUrl(NODE_REF, true, 20L);
        assertNull(directAccessUrl);
-        verify(mockContentStore, times(1)).requestContentDirectUrl(anyString(), eq(true), anyString(), anyLong());
+        verify(mockContentStore, times(1)).requestContentDirectUrl(anyString(), eq(true), anyString(), anyString(), anyLong());
    }

    /* Helper method to set system-wide direct access url configuration settings */
--- a/repository/src/test/java/org/alfresco/repo/content/caching/CachingContentStoreTest.java
+++ b/repository/src/test/java/org/alfresco/repo/content/caching/CachingContentStoreTest.java
@@ -505,8 +505,8 @@ public class CachingContentStoreTest
    {
        try
        {
-            when(backingStore.requestContentDirectUrl(anyString(), eq(true), anyString(), anyLong())).thenThrow(new UnsupportedOperationException());
-            cachingStore.requestContentDirectUrl("url", true,"someFile", 30L);
+            when(backingStore.requestContentDirectUrl(anyString(), eq(true), anyString(), anyString(), anyLong())).thenThrow(new UnsupportedOperationException());
+            cachingStore.requestContentDirectUrl("url", true,"someFile", "someMimetype", 30L);
            fail();
        }
        catch (UnsupportedOperationException e)
@@ -518,7 +518,7 @@ public class CachingContentStoreTest
    @Test
    public void getRequestContentDirectUrl()
    {
-        when(backingStore.requestContentDirectUrl(anyString(), eq(true), anyString(), anyLong())).thenReturn(new DirectAccessUrl());
-        cachingStore.requestContentDirectUrl("url", true,"someFile", 30L);
+        when(backingStore.requestContentDirectUrl(anyString(), eq(true), anyString(), anyString(), anyLong())).thenReturn(new DirectAccessUrl());
+        cachingStore.requestContentDirectUrl("url", true,"someFile", "someMimeType", 30L);
    }
 }
--- a/repository/src/test/java/org/alfresco/repo/content/replication/AggregatingContentStoreTest.java
+++ b/repository/src/test/java/org/alfresco/repo/content/replication/AggregatingContentStoreTest.java
@@ -227,14 +227,14 @@ public class AggregatingContentStoreTest extends AbstractWritableContentStoreTes
        UnsupportedContentUrlException unsupportedContentUrlExc = new UnsupportedContentUrlException(aggStore, "");

        // By default it is unsupported
-        DirectAccessUrl directAccessUrl = aggStore.requestContentDirectUrl("url", true, "anyfilename", 30L);
+        DirectAccessUrl directAccessUrl = aggStore.requestContentDirectUrl("url", true, "anyfilename", "anyMimetype", 30L);
        assertNull(directAccessUrl);

        // Direct access not supported
        try
        {
-            when(primaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedExc);
-            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedExc);
+            when(primaryStoreMock.requestContentDirectUrl(any(), any(), any(), any(), any())).thenThrow(unsupportedExc);
+            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any(), any())).thenThrow(unsupportedExc);
            aggStore.requestContentDirectUrl(eq("urlDANotSupported"), true, "anyfilename", 30L);
            fail();
        }
@@ -245,9 +245,9 @@ public class AggregatingContentStoreTest extends AbstractWritableContentStoreTes

        try
        {
-            when(primaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedExc);
-            aggStore.requestContentDirectUrl("urlDANotSupported", true, "anyfilename", 30L);
+            when(primaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any(), any())).thenThrow(unsupportedExc);
+            aggStore.requestContentDirectUrl("urlDANotSupported", true, "anyfilename", "anyMimetype", 30L);
            fail();
        }
        catch (UnsupportedOperationException e)
@@ -257,9 +257,9 @@ public class AggregatingContentStoreTest extends AbstractWritableContentStoreTes

        try
        {
-            when(primaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedExc);
-            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-            aggStore.requestContentDirectUrl("urlDANotSupported", true, "anyfilename", 30L);
+            when(primaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any(), any())).thenThrow(unsupportedExc);
+            when(secondaryStoreMock.requestContentDirectUrl(eq("urlDANotSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+            aggStore.requestContentDirectUrl("urlDANotSupported", true, "anyfilename", "anyMimetype", 30L);
            fail();
        }
        catch (UnsupportedOperationException e)
@@ -270,9 +270,9 @@ public class AggregatingContentStoreTest extends AbstractWritableContentStoreTes
        // Content url not supported
        try
        {
-            when(primaryStoreMock.requestContentDirectUrl(eq("urlNotSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-            when(secondaryStoreMock.requestContentDirectUrl(eq("urlNotSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-            aggStore.requestContentDirectUrl("urlNotSupported", true, "anyfilename", 30L);
+            when(primaryStoreMock.requestContentDirectUrl(eq("urlNotSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+            when(secondaryStoreMock.requestContentDirectUrl(eq("urlNotSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+            aggStore.requestContentDirectUrl("urlNotSupported", true, "anyfilename", "anyMimetype", 30L);
            fail();
        }
        catch (UnsupportedContentUrlException e)
@@ -280,31 +280,31 @@ public class AggregatingContentStoreTest extends AbstractWritableContentStoreTes
            // Expected
        }

-        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        when(secondaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any())).thenThrow(unsupportedExc);
-        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", 30L);
+        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        when(secondaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any(), any())).thenThrow(unsupportedExc);
+        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);

-        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        when(secondaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", 30L);
+        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        when(secondaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);

-        when(primaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any())).thenThrow(unsupportedExc);
-        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", 30L);
+        when(primaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any(), any())).thenThrow(unsupportedExc);
+        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);

-        when(primaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
-        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", 30L);
+        when(primaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any(), any())).thenThrow(unsupportedContentUrlExc);
+        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);

-        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any())).thenReturn(new DirectAccessUrl());
-        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", 30L);
+        when(primaryStoreMock.requestContentDirectUrl(eq("urlPriSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        when(secondaryStoreMock.requestContentDirectUrl(eq("urlSecSupported"), any(), any(), any(), any())).thenReturn(new DirectAccessUrl());
+        directAccessUrl = aggStore.requestContentDirectUrl("urlPriSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);
-        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", 30L);
+        directAccessUrl = aggStore.requestContentDirectUrl("urlSecSupported", true, "anyfilename", "anyMimetype", 30L);
        assertNotNull(directAccessUrl);
    }
 }
--- a/repository/src/test/java/org/alfresco/repo/node/NodeServiceTest.java
+++ b/repository/src/test/java/org/alfresco/repo/node/NodeServiceTest.java
@@ -41,6 +41,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -52,6 +53,8 @@ import org.alfresco.repo.cache.SimpleCache;
 import org.alfresco.repo.cache.TransactionalCache;
 import org.alfresco.repo.cache.TransactionalCache.ValueHolder;
 import org.alfresco.repo.content.MimetypeMap;
+import org.alfresco.repo.domain.contentdata.ContentDataDAO;
+import org.alfresco.repo.domain.contentdata.ContentUrlEntity;
 import org.alfresco.repo.domain.node.Node;
 import org.alfresco.repo.domain.node.NodeDAO;
 import org.alfresco.repo.domain.node.NodeEntity;
@@ -95,6 +98,9 @@ import org.alfresco.service.cmr.repository.StoreRef;
 import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
 import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.cmr.security.PersonService;
+import org.alfresco.service.cmr.version.Version;
+import org.alfresco.service.cmr.version.VersionHistory;
+import org.alfresco.service.cmr.version.VersionService;
 import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.service.namespace.RegexQNamePattern;
@@ -145,12 +151,15 @@ public class NodeServiceTest
    private static ContentService contentService;
    private static PermissionService permissionService;
    private static NodeDAO nodeDAO;
+    private static VersionService versionService;
    private static TransactionService txnService;
    private static PolicyComponent policyComponent;
    private static CannedQueryDAO cannedQueryDAOForTesting;
    private static SimpleCache<Serializable, ValueHolder<Serializable>> nodesCache;
    private static SimpleCache<Serializable, ValueHolder<Serializable>> propsCache;
    private static SimpleCache<Serializable, ValueHolder<Serializable>> aspectsCache;
+    private static SimpleCache<Long, ContentUrlEntity> contentDataCache;
+    private static SimpleCache<Long, ContentUrlEntity> contentUrlCache;
    
    private static Long deletedTypeQNameId;
    
@@ -168,6 +177,7 @@ public class NodeServiceTest
        contentService = serviceRegistry.getContentService();
        permissionService = serviceRegistry.getPermissionService();
        nodeDAO = (NodeDAO) APP_CONTEXT_INIT.getApplicationContext().getBean("nodeDAO");
+        versionService = serviceRegistry.getVersionService();
        txnService = serviceRegistry.getTransactionService();
        policyComponent = (PolicyComponent) APP_CONTEXT_INIT.getApplicationContext().getBean("policyComponent");
        cannedQueryDAOForTesting = (CannedQueryDAO) APP_CONTEXT_INIT.getApplicationContext().getBean("cannedQueryDAOForTesting");
@@ -176,11 +186,15 @@ public class NodeServiceTest
        nodesCache = (SimpleCache<Serializable, ValueHolder<Serializable>>) APP_CONTEXT_INIT.getApplicationContext().getBean("node.nodesSharedCache");
        propsCache = (SimpleCache<Serializable, ValueHolder<Serializable>>) APP_CONTEXT_INIT.getApplicationContext().getBean("node.propertiesSharedCache");
        aspectsCache = (SimpleCache<Serializable, ValueHolder<Serializable>>) APP_CONTEXT_INIT.getApplicationContext().getBean("node.aspectsSharedCache");
+        contentDataCache = (SimpleCache<Long, ContentUrlEntity>) APP_CONTEXT_INIT.getApplicationContext().getBean("contentDataCache");
+        contentUrlCache = (SimpleCache<Long, ContentUrlEntity>) APP_CONTEXT_INIT.getApplicationContext().getBean("contentUrlCache");
        
        // Clear the caches to remove fluff
        nodesCache.clear();
        propsCache.clear();
        aspectsCache.clear();
+        contentDataCache.clear();
+        contentUrlCache.clear();
        
        AuthenticationUtil.setRunAsUserSystem();
        
@@ -2433,6 +2447,125 @@ public class NodeServiceTest
            return null;
        }, userName1);
    }
+    
+    /**
+     * See MNT-22710
+     */
+    @Test
+    public void testChangeContentURLSameCRC()
+    {
+        ContentPropertyRestrictionInterceptor contentPropertyRestrictionInterceptor =
+                (ContentPropertyRestrictionInterceptor) APP_CONTEXT_INIT.getApplicationContext().getBean("contentPropertyRestrictionInterceptor");
+
+        contentPropertyRestrictionInterceptor.setGlobalContentPropertyRestrictionWhiteList(this.getClass().getName());
+        
+        try
+        {
+            NodeRef workspaceRootNodeRef = nodeService.getRootNode(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE);
+            Map<QName, Serializable> props = new HashMap<>(3);
+            props.put(ContentModel.PROP_NAME, GUID.generate());
+            NodeRef testFolder = nodeService.createNode(
+                    workspaceRootNodeRef,
+                    ContentModel.ASSOC_CHILDREN,
+                    QName.createQName(NAMESPACE, GUID.generate()),
+                    ContentModel.TYPE_FOLDER,
+                    props).getChildRef();
+             
+            NodeRef nodeRef1 = nodeService.createNode(
+                    testFolder,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName("180225704974-DSA Correspondence 1"),
+                    ContentModel.TYPE_CONTENT).getChildRef();
+            
+            NodeRef nodeRef2 = nodeService.createNode(
+                    testFolder,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName("090502800600-General Correspondence 1"),
+                    ContentModel.TYPE_CONTENT).getChildRef();
+            
+            // CRC: 2997538036
+            String contentURL1 = "s3v2://contentstore/1597325412593_1610985343942_3708/SLC/IC/DSA/2018/02/16/20/180225704974-DSA Correspondence 1";
+            // CRC: 2921900407
+            String contentURL2 = "s3v2://contentstore/1639588316822_1642775862393_49/SLC/IC/GENERAL/2009/05/27/16/090502800600-General Correspondence 1";
+            // CRC: 2997538036 (same CRC as contentURL1)
+            String contentURL3 = "s3v2://contentstore/1639588316821_1642775862393_49/SLC/IC/GENERAL/2009/05/27/16/090502800600-General Correspondence 1";
+            
+            ContentData contentData1 = new ContentData(
+                    contentURL1, 
+                    "application/pdf",
+                    100L, 
+                    "UTF-8"
+                    );
+            
+            ContentData contentData2 = new ContentData(
+                    contentURL2, 
+                    "application/pdf",
+                    100L, 
+                    "UTF-8"
+                    );
+            
+            ContentData contentData3 = new ContentData(
+                    contentURL3, 
+                    "application/pdf",
+                    100L, 
+                    "UTF-8"
+                    );
+            
+            // Setting same contentURLs
+            nodeService.setProperty(nodeRef1, ContentModel.PROP_CONTENT, contentData1);
+            nodeService.setProperty(nodeRef2, ContentModel.PROP_CONTENT, contentData1);
+            
+            //Validate the data
+            ContentData cdNode1Val0= (ContentData) nodeService.getProperty(nodeRef1, ContentModel.PROP_CONTENT);
+            ContentData cdNode2Val0= (ContentData) nodeService.getProperty(nodeRef2, ContentModel.PROP_CONTENT);
+            assertEquals("ContentURL for node1 should be contentURL1",contentURL1,cdNode1Val0.getContentUrl());
+            assertEquals("ContentURL for node2 should also be the same as node1",contentURL1,cdNode2Val0.getContentUrl());
+            
+            // Setting non colliding URLS
+            nodeService.setProperty(nodeRef2, ContentModel.PROP_CONTENT, contentData2);
+            
+            //Validate the data
+            ContentData cdNode1Val1= (ContentData) nodeService.getProperty(nodeRef1, ContentModel.PROP_CONTENT);
+            ContentData cdNode2Val1= (ContentData) nodeService.getProperty(nodeRef2, ContentModel.PROP_CONTENT);
+            assertEquals("ContentURL for node1 should be contentURL1",contentURL1,cdNode1Val1.getContentUrl());
+            assertEquals("ContentURL for node2 should be contentURL2",contentURL2,cdNode2Val1.getContentUrl());
+            
+            //Set a colliding URL
+            try
+            {
+                nodeService.setProperty(nodeRef2, ContentModel.PROP_CONTENT, contentData3);
+                fail("Should not be possible to set a contentUrl with the same CRC and different value");
+            }
+            catch (IllegalArgumentException e)
+            {
+                //Expected
+            }
+            
+            //Validate the contentURL values
+            ContentData cdNode1Val2= (ContentData) nodeService.getProperty(nodeRef1, ContentModel.PROP_CONTENT);
+            ContentData cdNode2Val2= (ContentData) nodeService.getProperty(nodeRef2, ContentModel.PROP_CONTENT);
+            assertFalse("Collision detected on node 1",contentURL3.equals(cdNode1Val2.getContentUrl()));
+            assertFalse("Collision detected on node 2",contentURL1.equals(cdNode2Val2.getContentUrl()));
+            
+            //Clear caches and validate again
+            propsCache.clear();
+            contentDataCache.clear();
+            contentUrlCache.clear();
+            
+            ContentData cdNode1Val3= (ContentData) nodeService.getProperty(nodeRef1, ContentModel.PROP_CONTENT);
+            ContentData cdNode2Val3= (ContentData) nodeService.getProperty(nodeRef2, ContentModel.PROP_CONTENT);
+            assertFalse("Collision detected on node 1 after clear caches",contentURL3.equals(cdNode1Val3.getContentUrl()));
+            assertFalse("Collision detected on node 2 after clear caches",contentURL1.equals(cdNode2Val3.getContentUrl()));
+            
+            assertEquals("ContentURL for node1 should be contentURL1",contentURL1,cdNode1Val3.getContentUrl());
+            assertEquals("ContentURL for node2 should be contentURL2",contentURL2,cdNode2Val3.getContentUrl());
+        }
+        finally
+        {
+            contentPropertyRestrictionInterceptor.setGlobalContentPropertyRestrictionWhiteList("");
+        }
+        
+    }

    private void addContentToNode(NodeRef nodeRef)
    {
Author	SHA1	Message	Date
Travis CI User	33a11b68df	[maven-release-plugin][skip ci] prepare release 13.8	2022-08-22 11:07:43 +00:00
mikolajbrzezinski	9bd0c4c699	ACS-3316 Fix custom models downloading and XSS (#1304 ) (#1320 ) * Revert "Revert "ACS-3316 Fix HTML sanitisation bypass (#1266)" (#1294)" This reverts commit `6c407b1ef5`. * ACS-3316 Set node name for download node * ACS-3316 Update license Co-authored-by: Damian.Ujma@hyland.com <Damian.Ujma@hyland.com> (cherry picked from commit `cc3f8aaff4`)	2022-08-22 12:07:30 +02:00
Travis CI User	a893a92fe9	[maven-release-plugin][skip ci] prepare for next development iteration	2022-07-28 21:29:53 +00:00
Travis CI User	71c6ae0c46	[maven-release-plugin][skip ci] prepare release 13.7	2022-07-28 21:29:50 +00:00
Jared Ottley	fad9785cb8	ACS-2064 DAU: Fix response content type always PDF (#754 ) (#1260 ) * ACS-2064 ContentStore.java to require mimetype - Updates the ContentStore interface to also require a mimetype, deprecates old method signatures - Original interface methods maintained so code should be backwards compatible - Implementing classes updated to reflect changes Co-authored-by: David Edwards <david.edwards@alfresco.com>	2022-07-28 14:09:18 -06:00
Travis CI User	99f57d545b	[maven-release-plugin][skip ci] prepare for next development iteration	2022-07-14 18:01:11 +00:00
Travis CI User	2ee88f6c9e	[maven-release-plugin][skip ci] prepare release 13.6	2022-07-14 18:01:08 +00:00
tiagosalvado10	52a2250c56	[ACS-3271] Update MySQL 5.7.23 tests to 5.7.28 version (#1209 ) (#1215 ) * ACS-3271 Update MySQL 5.7.23 tests to 5.7.28 version (#1209) (cherry picked from commit `3990bc9db4`) Co-authored-by: Damian Ujma <92095156+damianujma@users.noreply.github.com>	2022-07-14 17:22:19 +01:00
Travis CI User	4b8e8d8085	[maven-release-plugin][skip ci] prepare for next development iteration	2022-05-02 17:44:32 +00:00
Travis CI User	95f8018b43	[maven-release-plugin][skip ci] prepare release 13.5	2022-05-02 17:44:29 +00:00
evasques	1b1548c82d	MNT-22968 - Bump Freemarker (#1095 )	2022-05-02 18:03:41 +01:00
Travis CI User	a82cd184e6	[maven-release-plugin][skip ci] prepare for next development iteration	2022-04-08 17:31:50 +00:00
Travis CI User	1d544d4e2e	[maven-release-plugin][skip ci] prepare release 13.4	2022-04-08 17:31:46 +00:00
Vítor Moreira	0e90eeaa06	Fix/mnt 22946 spring rce databind jdk9 71 n (#1056 ) * Bump dependency.webscripts.version from 8.28 to 8.29 (#1052) (cherry picked from commit `22a0343c41`) * MNT-22946: bump spring version to 5.3.18 (#1054) (cherry picked from commit `53777cd5b9`)	2022-04-08 13:53:31 +01:00
Travis CI User	a2e08e1ebd	[maven-release-plugin][skip ci] prepare for next development iteration	2022-02-18 11:02:38 +00:00
Travis CI User	72ec0e8f2c	[maven-release-plugin][skip ci] prepare release 13.3	2022-02-18 11:02:35 +00:00
evasques	19dee63bc4	MNT-22710 - ContentURLs with CRC collision and same last 12 chars are assumed as duplicates and node is linked to the wrong contentURL (#944 ) (#973 ) * Added a validation to assure the URL is the same and if it is not, throw an error * Added a unit test to replicate the problem (cherry picked from commit `85b5b2660e`)	2022-02-18 10:20:34 +00:00
Travis CI User	3dd612dd66	[maven-release-plugin][skip ci] prepare for next development iteration	2022-02-04 15:31:33 +00:00