[maven-release-plugin][skip ci] prepare release 21.18

(cherry picked from commit 582fc8ec2d)

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     if: >
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -52,7 +52,7 @@ jobs:
     if: >
       ((github.ref_name == 'master' || startsWith(github.ref_name, 'release/')) && github.event_name != 'pull_request') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -73,7 +73,7 @@ jobs:
     if: >
       !contains(github.event.head_commit.message, '[skip repo]') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -94,7 +94,7 @@ jobs:
     if: >
       !contains(github.event.head_commit.message, '[skip repo]') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -139,7 +139,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip db]')) ||
       contains(github.event.head_commit.message, '[db]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -169,7 +169,7 @@ jobs:
       contains(github.event.head_commit.message, '[latest db]') ||
       contains(github.event.head_commit.message, '[db]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -195,7 +195,7 @@ jobs:
       contains(github.event.head_commit.message, '[latest db]') ||
       contains(github.event.head_commit.message, '[db]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -220,7 +220,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip db]')) ||
       contains(github.event.head_commit.message, '[db]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -245,7 +245,7 @@ jobs:
       contains(github.event.head_commit.message, '[latest db]') ||
       contains(github.event.head_commit.message, '[db]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -268,7 +268,7 @@ jobs:
     if: >
       !contains(github.event.head_commit.message, '[skip repo]') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -289,7 +289,7 @@ jobs:
     if: >
       !contains(github.event.head_commit.message, '[skip repo]') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -358,7 +358,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tas]')) ||
       contains(github.event.head_commit.message, '[tas]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -385,18 +385,24 @@ jobs:
             pom-dir: tas-email
           - test-name: "WebDAV TAS tests"
             pom-dir: tas-webdav
-          - test-name: "Integration TAS tests"
+          - test-name: "Integration TAS tests (Java 17)"
             pom-dir: tas-integration
+          - test-name: "Integration TAS tests (Java 11)"
+            pom-dir: tas-integration
+            jre-version: 11
     env:
       REQUIRES_LOCAL_IMAGES: true
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v1.33.0
+        with:
+          java-version: ${{ matrix.jre-version || '17' }}
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
           bash ./scripts/ci/init.sh
+          export BUILD_OPTIONS="-Ddocker.buildArg.JRE_VERSION=${{ matrix.jre-version }} ${BUILD_OPTIONS}"
           bash ./scripts/ci/build.sh
       - name: "Set up the environment"
         run: |
@@ -425,7 +431,7 @@ jobs:
     if: >
       !contains(github.event.head_commit.message, '[skip repo]') &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v3
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.33.0
@@ -448,7 +454,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip ags]')) ||
       contains(github.event.head_commit.message, '[ags]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -479,7 +485,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip ags]')) ||
       contains(github.event.head_commit.message, '[ags on MySQL]')) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     strategy:
       fail-fast: false
       matrix:
@@ -510,7 +516,7 @@ jobs:
       !contains(github.event.head_commit.message, '[skip ags]') && !contains(github.event.head_commit.message, '[skip tas]')) ||
       (contains(github.event.head_commit.message, '[ags]') && contains(github.event.head_commit.message, '[tas]'))) &&
       !contains(github.event.head_commit.message, '[skip tests]') &&
-      !contains(github.event.head_commit.message, '[force]')
+      !contains(github.event.head_commit.message, '[force')
     env:
       REQUIRES_LOCAL_IMAGES: true
     steps:

amps/ags/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <build>

amps/ags/rm-community/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <modules>

amps/ags/rm-community/rm-community-repo/pom.xml

@@ -8,7 +8,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <properties>

amps/ags/rm-community/rm-community-repo/test/resources/alfresco/version.properties

@@ -5,7 +5,7 @@
 # Version label
 version.major=7
 version.minor=4
-version.revision=0
+version.revision=1
 version.label=
 
 # Edition label

amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <build>

amps/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <modules>

amps/share-services/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <properties>

amps/share-services/src/main/resources/alfresco/templates/webscripts/org/alfresco/collaboration/tagQuery.get.js

@@ -48,7 +48,7 @@ function tagQuery()
    }
    query += "ASPECT:\"{http://www.alfresco.org/model/content/1.0}taggable\"";
    //MNT-2118 Share inconsistencies when displaying locked files with tags
-   query += " -ASPECT:\"{http://www.alfresco.org/model/content/1.0}workingcopy\"";
+   query += " AND -ASPECT:\"{http://www.alfresco.org/model/content/1.0}workingcopy\"";
 
    // MNT-20091 check to prevent cm:taggable with NULL
    query += " AND ISNOTNULL:\"{http://www.alfresco.org/model/content/1.0}taggable\"";
@@ -60,7 +60,7 @@ function tagQuery()
          query: query,
          language: "lucene",
          page: {
-            // query minimum rows because all usefull info will come with facets 
+            // query minimum rows because all useful info will come with facets
             maxItems: 1,
             skipCount: 0
          },

amps/share-services/src/main/resources/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/categorynode.get.js

@@ -24,7 +24,7 @@ function getCategoryNode()
       else
       {
          var queryPath = "/" + catAspect + "/" + encodePath(path);
-         categoryResults = search.luceneSearch("+PATH:\"" + queryPath + "/*\" -PATH:\"" + queryPath + "/member\"");
+         categoryResults = search.luceneSearch("+PATH:\"" + queryPath + "/*\" AND -PATH:\"" + queryPath + "/member\"");
       }
       
       // make each result an object and indicate it is selectable in the UI
@@ -71,4 +71,4 @@ function encodePath(path)
 function sortByName(a, b)
 {
    return (b.node.name.toLowerCase() > a.node.name.toLowerCase() ? -1 : 1);
-}
+}

amps/share-services/src/main/resources/alfresco/templates/webscripts/org/alfresco/slingshot/documentlibrary/images.get.js

@@ -29,7 +29,7 @@ function main()
    {
       query = "+PATH:\"" + parsedArgs.pathNode.qnamePath + "//*\" ";
    }
-   query += "+TYPE:\"cm:content\" +@cm\\:content.mimetype:image/*";
+   query += "AND +TYPE:\"cm:content\" AND +@cm\\:content.mimetype:\"image/*\"";
    
    // Sort the list before trimming to page chunks 
    assets = search.query(
@@ -52,4 +52,4 @@ function main()
 /**
  * Images List Component: images
  */
-model.images = main();
+model.images = main();

core/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo</artifactId>
-      <version>20.155</version>
+      <version>21.18</version>
    </parent>
 
    <dependencies>

core/src/main/java/org/alfresco/httpclient/HttpClient4Factory.java

@@ -92,15 +92,16 @@ public class HttpClient4Factory
         else
         {
             //Setting a connectionManager overrides these properties
-            clientBuilder.setMaxConnTotal(config.getMaxTotalConnections());
-            clientBuilder.setMaxConnPerRoute(config.getMaxHostConnections());
+            config.getMaxTotalConnections().ifPresent(v -> clientBuilder.setMaxConnTotal(v));
+            config.getMaxHostConnections().ifPresent(v -> clientBuilder.setMaxConnPerRoute(v));
         }
 
-        RequestConfig requestConfig = RequestConfig.custom()
-               .setConnectTimeout(config.getConnectionTimeout())
-               .setSocketTimeout(config.getSocketTimeout())
-               .setConnectionRequestTimeout(config.getConnectionRequestTimeout())
-               .build();
+        RequestConfig.Builder requestConfigBuilder = RequestConfig.custom();
+        config.getConnectionTimeout().ifPresent(v -> requestConfigBuilder.setConnectTimeout(v));
+        config.getConnectionRequestTimeout().ifPresent(v -> requestConfigBuilder.setConnectionRequestTimeout(v));
+        config.getSocketTimeout().ifPresent(v -> requestConfigBuilder.setSocketTimeout(v));
+
+        RequestConfig requestConfig = requestConfigBuilder.build();
 
         clientBuilder.setDefaultRequestConfig(requestConfig);
 
@@ -135,8 +136,8 @@ public class HttpClient4Factory
                    .register("http", PlainConnectionSocketFactory.getSocketFactory())
                    .build());
         }
-        poolingHttpClientConnectionManager.setMaxTotal(config.getMaxTotalConnections());
-        poolingHttpClientConnectionManager.setDefaultMaxPerRoute(config.getMaxHostConnections());
+        config.getMaxTotalConnections().ifPresent(v -> poolingHttpClientConnectionManager.setMaxTotal(v));
+        config.getMaxHostConnections().ifPresent(v -> poolingHttpClientConnectionManager.setDefaultMaxPerRoute(v));
 
         return poolingHttpClientConnectionManager;
     }

core/src/main/java/org/alfresco/httpclient/HttpClientConfig.java

@@ -85,17 +85,27 @@ public class HttpClientConfig
         this.keyStore = new AlfrescoKeyStoreImpl(sslEncryptionParameters.getKeyStoreParameters(),  keyResourceLoader);
         this.trustStore = new AlfrescoKeyStoreImpl(sslEncryptionParameters.getTrustStoreParameters(), keyResourceLoader);
 
-        config = retrieveConfig(serviceName);
+        config = retrieveConfig();
         checkUnsupportedProperties(config);
     }
 
     /**
      * Method used for retrieving HttpClient config from Global Properties
-     * @param serviceName name of used service
+     * that can also have values provided/overridden through System Properties
+     *
      * @return map of properties
      */
-    private Map<String, String> retrieveConfig(String serviceName)
+    private Map<String, String> retrieveConfig()
     {
+        Map<String, String> resultProperties = getHttpClientPropertiesForService(properties);
+        Map<String, String> systemProperties = getHttpClientPropertiesForService(System.getProperties());
+
+        systemProperties.forEach((k, v) -> resultProperties.put(k, v)); //Override/Add to Global Properties results with values from System Properties
+
+        return resultProperties;
+    }
+
+    private Map<String, String> getHttpClientPropertiesForService(Properties properties) {
         return properties.keySet().stream()
                 .filter(key -> key instanceof String)
                 .map(Object::toString)
@@ -112,79 +122,75 @@ public class HttpClientConfig
               .forEach(propertyName -> LOGGER.warn(String.format("For service [%s], an unsupported property [%s] is set", serviceName, propertyName)));
     }
 
-    private Integer getIntegerProperty(HttpClientPropertiesEnum property)
+    private Optional<Integer> getIntegerProperty(HttpClientPropertiesEnum property)
     {
-        return Integer.parseInt(extractValueFromConfig(property).orElse("0"));
+        Optional<String> optionalProperty = extractValueFromConfig(property);
+
+        return optionalProperty.isPresent() ? Optional.of(Integer.parseInt(optionalProperty.get())) : Optional.empty();
     }
 
-    private Boolean getBooleanProperty(HttpClientPropertiesEnum property)
+    private Optional<Boolean> getBooleanProperty(HttpClientPropertiesEnum property)
     {
-        return Boolean.parseBoolean(extractValueFromConfig(property).orElse("false"));
+        Optional<String> optionalProperty = extractValueFromConfig(property);
+
+        return optionalProperty.isPresent() ? Optional.of(Boolean.parseBoolean(optionalProperty.get())) : Optional.empty();
     }
 
     private Optional<String> extractValueFromConfig(HttpClientPropertiesEnum property)
     {
-        Optional<String> optionalProperty = Optional.ofNullable(config.get(property.name));
-        if(property.isRequired && optionalProperty.isEmpty())
-        {
-            String msg = String.format("Required property: '%s' is empty.", property.name);
-            throw new HttpClientException(msg);
-        }
-        return optionalProperty;
+        return Optional.ofNullable(config.get(property.name));
     }
 
-    public Integer getConnectionTimeout()
+    public Optional<Integer> getConnectionTimeout()
     {
         return getIntegerProperty(HttpClientPropertiesEnum.CONNECTION_REQUEST_TIMEOUT);
     }
 
-    public Integer getSocketTimeout()
+    public Optional<Integer> getSocketTimeout()
     {
         return getIntegerProperty(HttpClientPropertiesEnum.SOCKET_TIMEOUT);
     }
 
-    public Integer getConnectionRequestTimeout()
+    public Optional<Integer> getConnectionRequestTimeout()
     {
         return getIntegerProperty(HttpClientPropertiesEnum.CONNECTION_REQUEST_TIMEOUT);
     }
 
-    public Integer getMaxTotalConnections()
+    public Optional<Integer> getMaxTotalConnections()
     {
         return getIntegerProperty(HttpClientPropertiesEnum.MAX_TOTAL_CONNECTIONS);
     }
 
-    public Integer getMaxHostConnections()
+    public Optional<Integer> getMaxHostConnections()
     {
         return getIntegerProperty(HttpClientPropertiesEnum.MAX_HOST_CONNECTIONS);
     }
 
-    public Boolean isMTLSEnabled()
+    public boolean isMTLSEnabled()
     {
-        return getBooleanProperty(HttpClientPropertiesEnum.MTLS_ENABLED);
+        return getBooleanProperty(HttpClientPropertiesEnum.MTLS_ENABLED).orElse(Boolean.FALSE);
     }
 
     public boolean isHostnameVerificationDisabled()
     {
-        return getBooleanProperty(HttpClientPropertiesEnum.HOSTNAME_VERIFICATION_DISABLED);
+        return getBooleanProperty(HttpClientPropertiesEnum.HOSTNAME_VERIFICATION_DISABLED).orElse(Boolean.FALSE);
     }
 
     private enum HttpClientPropertiesEnum
     {
-        CONNECTION_TIMEOUT("connectionTimeout", true),
-        SOCKET_TIMEOUT("socketTimeout", true),
-        CONNECTION_REQUEST_TIMEOUT("connectionRequestTimeout", true),
-        MAX_TOTAL_CONNECTIONS("maxTotalConnections", true),
-        MAX_HOST_CONNECTIONS("maxHostConnections", true),
-        HOSTNAME_VERIFICATION_DISABLED("hostnameVerificationDisabled", false),
-        MTLS_ENABLED("mTLSEnabled", true);
+        CONNECTION_TIMEOUT("connectionTimeout"),
+        SOCKET_TIMEOUT("socketTimeout"),
+        CONNECTION_REQUEST_TIMEOUT("connectionRequestTimeout"),
+        MAX_TOTAL_CONNECTIONS("maxTotalConnections"),
+        MAX_HOST_CONNECTIONS("maxHostConnections"),
+        HOSTNAME_VERIFICATION_DISABLED("hostnameVerificationDisabled"),
+        MTLS_ENABLED("mTLSEnabled");
 
         private final String name;
-        private final Boolean isRequired;
 
-        HttpClientPropertiesEnum(String propertyName, Boolean isRequired)
+        HttpClientPropertiesEnum(String propertyName)
         {
             this.name = propertyName;
-            this.isRequired = isRequired;
         }
 
         private static final List<String> supportedProperties = new ArrayList<>();

data-model/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <properties>

data-model/src/main/java/org/alfresco/service/cmr/search/SearchParameters.java

@@ -201,6 +201,11 @@ public class SearchParameters implements BasicSearchParameters
 
     private String timezone;
     
+    /**
+     * Configure the limit to track the total hits on search results
+     */
+    private int trackTotalHits;
+
     /**
      * Default constructor
      */
@@ -251,6 +256,7 @@ public class SearchParameters implements BasicSearchParameters
         sp.stats = this.stats;
         sp.ranges = this.ranges;
         sp.timezone = this.timezone;
+        sp.trackTotalHits = this.trackTotalHits;
         return sp;
     }
     
@@ -1641,6 +1647,21 @@ public class SearchParameters implements BasicSearchParameters
     {
         this.includeMetadata = includeMetadata;
     }
-    
+
+    public int getTrackTotalHits()
+    {
+        return trackTotalHits;
+    }
+
+    /**
+     * Set a maximum value for the report of total hits. The reported number of hits will never exceed this limit even
+     * if more are found. If unset, the engine’s default tracking limit is applied. To remove any limit, set to -1.
+     *
+     * @param trackTotalHits int
+     */
+    public void setTrackTotalHits(int trackTotalHits)
+    {
+        this.trackTotalHits = trackTotalHits;
+    }
 
 }

mmt/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <dependencies>

packaging/distribution/pom.xml

@@ -9,6 +9,6 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 </project>

packaging/docker-alfresco/Dockerfile

@@ -1,6 +1,8 @@
+ARG JRE_VERSION=17
+
 # Fetch image based on Tomcat 9.0, Java 17 and Rocky Linux 8
 # More infos about this image: https://github.com/Alfresco/alfresco-docker-base-tomcat
-FROM alfresco/alfresco-base-tomcat:tomcat9-jre17-rockylinux8-202303081618
+FROM alfresco/alfresco-base-tomcat:tomcat9-jre${JRE_VERSION}-rockylinux8-202303081618
 
 # Set default docker_context.
 ARG resource_path=target

packaging/docker-alfresco/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <properties>

packaging/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <modules>

packaging/tests/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <modules>

packaging/tests/tas-cmis/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <organization>

packaging/tests/tas-email/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <developers>

packaging/tests/tas-integration/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <developers>

packaging/tests/tas-restapi/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <properties>

packaging/tests/tas-restapi/src/main/java/org/alfresco/rest/search/RestRequestLimitsModel.java

@@ -0,0 +1,82 @@
+/*-
+ * #%L
+ * alfresco-tas-restapi
+ * %%
+ * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software. 
+ * If the software was purchased under a paid Alfresco license, the terms of 
+ * the paid license agreement will prevail.  Otherwise, the software is 
+ * provided under the following open source license terms:
+ * 
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ * 
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.rest.search;
+
+import org.alfresco.rest.core.IRestModel;
+import org.alfresco.utility.model.TestModel;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+public class RestRequestLimitsModel extends TestModel implements IRestModel<RestRequestLimitsModel>
+{
+    @JsonProperty
+    RestRequestLimitsModel model;
+
+    private Integer permissionEvaluationTime;
+    private Integer permissionEvaluationCount;
+    private Integer trackTotalHitsLimit;
+
+    @Override
+    public RestRequestLimitsModel onModel()
+    {
+        return model;
+    }
+    
+    public RestRequestLimitsModel(Integer permissionEvaluationTime, Integer permissionEvaluationCount,
+            Integer trackTotalHitsLimit)
+    {
+        super();
+        this.permissionEvaluationTime = permissionEvaluationTime;
+        this.permissionEvaluationCount = permissionEvaluationCount;
+        this.trackTotalHitsLimit = trackTotalHitsLimit;
+    }
+
+    public Integer getPermissionEvaluationTime()
+    {
+        return permissionEvaluationTime;
+    }
+    public void setPermissionEvaluationTime(Integer permissionEvaluationTime)
+    {
+        this.permissionEvaluationTime = permissionEvaluationTime;
+    }
+    public Integer getPermissionEvaluationCount()
+    {
+        return permissionEvaluationCount;
+    }
+    public void setPermissionEvaluationCount(Integer permissionEvaluationCount)
+    {
+        this.permissionEvaluationCount = permissionEvaluationCount;
+    }
+    public Integer getTrackTotalHitsLimit()
+    {
+        return trackTotalHitsLimit;
+    }
+    public void setTrackTotalHitsLimit(Integer trackTotalHitsLimit)
+    {
+        this.trackTotalHitsLimit = trackTotalHitsLimit;
+    }
+}
+ 

packaging/tests/tas-restapi/src/main/java/org/alfresco/rest/search/SearchRequest.java

@@ -76,6 +76,7 @@ public class SearchRequest extends TestModel
     String facetFormat;
     List<String> include;
     List<SortClause> sort;
+    RestRequestLimitsModel limits;
 
     public SearchRequest()
     {
@@ -279,4 +280,15 @@ public class SearchRequest extends TestModel
 
         return this;
     }
+
+    public RestRequestLimitsModel getLimits()
+    {
+        return limits;
+    }
+
+    public void setLimits(RestRequestLimitsModel limits)
+    {
+        this.limits = limits;
+    }
+
 }

packaging/tests/tas-webdav/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <developers>

packaging/war/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <properties>

pom.xml

@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>alfresco-community-repo</artifactId>
-    <version>20.155</version>
+    <version>21.18</version>
     <packaging>pom</packaging>
     <name>Alfresco Community Repo Parent</name>
 
@@ -25,7 +25,7 @@
     <properties>
         <acs.version.major>7</acs.version.major>
         <acs.version.minor>4</acs.version.minor>
-        <acs.version.revision>0</acs.version.revision>
+        <acs.version.revision>1</acs.version.revision>
         <acs.version.label />
         <amp.min.version>${acs.version.major}.0.0</amp.min.version>
 
@@ -52,8 +52,8 @@
         <dependency.alfresco-messaging-repo.version>1.2.20</dependency.alfresco-messaging-repo.version>
         <dependency.activiti-engine.version>5.23.0</dependency.activiti-engine.version>
         <dependency.activiti.version>5.23.0</dependency.activiti.version>
-        <dependency.alfresco-transform-service.version>2.1.0-A9</dependency.alfresco-transform-service.version>
-        <dependency.alfresco-transform-core.version>3.1.0-A12</dependency.alfresco-transform-core.version>
+        <dependency.alfresco-transform-service.version>2.1.0</dependency.alfresco-transform-service.version>
+        <dependency.alfresco-transform-core.version>3.1.0</dependency.alfresco-transform-core.version>
         <dependency.alfresco-greenmail.version>6.5</dependency.alfresco-greenmail.version>
         <dependency.acs-event-model.version>0.0.18</dependency.acs-event-model.version>
 
@@ -62,7 +62,7 @@
         <dependency.jackson.version>2.15.0-rc1</dependency.jackson.version>
         <dependency.cxf.version>3.5.5</dependency.cxf.version>
         <dependency.opencmis.version>1.0.0</dependency.opencmis.version>
-        <dependency.webscripts.version>8.40</dependency.webscripts.version>
+        <dependency.webscripts.version>8.47</dependency.webscripts.version>
         <dependency.bouncycastle.version>1.70</dependency.bouncycastle.version>
         <dependency.mockito-core.version>4.9.0</dependency.mockito-core.version>
         <dependency.assertj.version>3.24.2</dependency.assertj.version>
@@ -79,7 +79,7 @@
         <dependency.gytheio.version>0.18</dependency.gytheio.version>
         <dependency.groovy.version>3.0.16</dependency.groovy.version>
         <dependency.tika.version>2.4.1</dependency.tika.version>
-        <dependency.spring-security.version>5.8.2</dependency.spring-security.version>
+        <dependency.spring-security.version>5.8.3</dependency.spring-security.version>
         <dependency.truezip.version>7.7.10</dependency.truezip.version>
         <dependency.poi.version>5.2.2</dependency.poi.version>
         <dependency.poi-ooxml-lite.version>5.2.3</dependency.poi-ooxml-lite.version>
@@ -111,9 +111,9 @@
         <dependency.json-smart.version>2.4.10</dependency.json-smart.version>
         <dependency.jakarta-rpc-api.version>1.1.4</dependency.jakarta-rpc-api.version>
 
-        <alfresco.googledrive.version>3.4.0-A4</alfresco.googledrive.version>
-        <alfresco.aos-module.version>1.6.0-A5</alfresco.aos-module.version>
-        <alfresco.api-explorer.version>7.3.0</alfresco.api-explorer.version> <!-- Also in alfresco-enterprise-share -->
+        <alfresco.googledrive.version>3.4.2</alfresco.googledrive.version>
+        <alfresco.aos-module.version>1.6.2</alfresco.aos-module.version>
+        <alfresco.api-explorer.version>7.4.0</alfresco.api-explorer.version> <!-- Also in alfresco-enterprise-share -->
 
         <alfresco.maven-plugin.version>2.2.0</alfresco.maven-plugin.version>
         <license-maven-plugin.version>2.0.1.alfresco-2</license-maven-plugin.version>
@@ -150,7 +150,7 @@
         <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
         <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
         <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>20.155</tag>
+        <tag>21.18</tag>
     </scm>
 
     <distributionManagement>

remote-api/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <dependencies>

remote-api/src/main/java/org/alfresco/rest/api/search/impl/SearchMapper.java

@@ -823,6 +823,11 @@ public class SearchMapper
                 sp.setLimitBy(LimitBy.NUMBER_OF_PERMISSION_EVALUATIONS);
                 sp.setMaxPermissionCheckTimeMillis(limits.getPermissionEvaluationTime());
             }
+
+            if(limits.getTrackTotalHitsLimit() != null)
+            {
+                sp.setTrackTotalHits(limits.getTrackTotalHitsLimit());
+            }
         }
     }
 

remote-api/src/main/java/org/alfresco/rest/api/search/model/FacetField.java

@@ -93,7 +93,7 @@ public class FacetField
 
     public String toFilterQuery(String value)
     {
-        return field+":\""+value+"\"";
+        return ("Null".equals(value)) ? "ISNULL:\"" + field + "\"" : field + ":\"" + value + "\"";
     }
 
     public String getPrefix()

remote-api/src/main/java/org/alfresco/rest/api/search/model/Limits.java

@@ -37,13 +37,16 @@ public class Limits
 
     private final Integer permissionEvaluationTime;
     private final Integer permissionEvaluationCount;
+    private final Integer trackTotalHitsLimit;
 
     @JsonCreator
     public Limits(@JsonProperty("permissionEvaluationTime") Integer permissionEvaluationTime,
-                  @JsonProperty("permissionEvaluationCount") Integer permissionEvaluationCount)
+                  @JsonProperty("permissionEvaluationCount") Integer permissionEvaluationCount,
+                  @JsonProperty("trackTotalHitsLimit") Integer trackTotalHitsLimit)
     {
         this.permissionEvaluationTime = permissionEvaluationTime;
         this.permissionEvaluationCount = permissionEvaluationCount;
+        this.trackTotalHitsLimit = trackTotalHitsLimit;
     }
 
     public Integer getPermissionEvaluationTime()
@@ -55,4 +58,9 @@ public class Limits
     {
         return permissionEvaluationCount;
     }
+
+    public Integer getTrackTotalHitsLimit()
+    {
+        return trackTotalHitsLimit;
+    }
 }

remote-api/src/test/java/org/alfresco/rest/api/search/SearchMapperTests.java

@@ -745,33 +745,56 @@ public class SearchMapperTests
     }
 
     @Test
-    public void fromLimits() throws Exception
+    public void fromLimits_setNull() throws Exception
     {
         SearchParameters searchParameters = new SearchParameters();
         searchMapper.setDefaults(searchParameters);
-
-        //Doesn't error
         searchMapper.fromLimits(searchParameters, null);
-        assertEquals(500, searchParameters.getLimit());
-        assertEquals(LimitBy.UNLIMITED, searchParameters.getLimitBy());
+        assertEquals("LimitBy default value should be unlimited", LimitBy.UNLIMITED, searchParameters.getLimitBy());
+        assertEquals("Limit default value should be 500", 500, searchParameters.getLimit());
+    }
 
-        searchMapper.fromLimits(searchParameters, new Limits(null, null));
-        assertEquals(LimitBy.UNLIMITED, searchParameters.getLimitBy());
-        assertEquals(500, searchParameters.getLimit());
-
-        searchMapper.fromLimits(searchParameters, new Limits(null, 34));
-        assertEquals(LimitBy.NUMBER_OF_PERMISSION_EVALUATIONS, searchParameters.getLimitBy());
-        assertEquals(34, searchParameters.getMaxPermissionChecks());
-        assertEquals(-1, searchParameters.getLimit());
-        assertEquals(-1, searchParameters.getMaxPermissionCheckTimeMillis());
-
-        searchParameters = new SearchParameters();
+    @Test
+    public void fromLimits_setAllLimitsAsNull() throws Exception
+    {
+        SearchParameters searchParameters = new SearchParameters();
         searchMapper.setDefaults(searchParameters);
-        searchMapper.fromLimits(searchParameters, new Limits(1000, null));
+        searchMapper.fromLimits(searchParameters, new Limits(null, null, null));
+        assertEquals("LimitBy default value should be unlimited", LimitBy.UNLIMITED, searchParameters.getLimitBy());
+        assertEquals("Limit default value should be 500", 500, searchParameters.getLimit());
+    }
+
+    @Test
+    public void fromLimits_setPermissionEvaluationCount() throws Exception
+    {
+        SearchParameters searchParameters = new SearchParameters();
+        searchMapper.setDefaults(searchParameters);
+        searchMapper.fromLimits(searchParameters, new Limits(null, 34, null));
         assertEquals(LimitBy.NUMBER_OF_PERMISSION_EVALUATIONS, searchParameters.getLimitBy());
-        assertEquals(1000, searchParameters.getMaxPermissionCheckTimeMillis());
-        assertEquals(-1, searchParameters.getLimit());
-        assertEquals(-1, searchParameters.getMaxPermissionChecks());
+        assertEquals("MaxPermissionChecks should be set", 34, searchParameters.getMaxPermissionChecks());
+        assertEquals("Limit should be -1", -1, searchParameters.getLimit());
+        assertEquals("MaxPermissionCheckTimeMillis should be -1", -1, searchParameters.getMaxPermissionCheckTimeMillis());
+    }
+
+    @Test
+    public void fromLimits_setPermissionEvaluationTime() throws Exception
+    {
+        SearchParameters searchParameters = new SearchParameters();
+        searchMapper.setDefaults(searchParameters);
+        searchMapper.fromLimits(searchParameters, new Limits(1000, null, null));
+        assertEquals(LimitBy.NUMBER_OF_PERMISSION_EVALUATIONS, searchParameters.getLimitBy());
+        assertEquals("MaxPermissionCheckTimeMillis should be set", 1000, searchParameters.getMaxPermissionCheckTimeMillis());
+        assertEquals("Limit should be -1", -1, searchParameters.getLimit());
+        assertEquals("MaxPermissionChecks should be -1", -1, searchParameters.getMaxPermissionChecks());
+    }
+
+    @Test
+    public void fromLimits_setTrackTotalHitsLimit() throws Exception
+    {
+        SearchParameters searchParameters = new SearchParameters();
+        searchMapper.setDefaults(searchParameters);
+        searchMapper.fromLimits(searchParameters, new Limits(null, null, 10));
+        assertEquals("TrackTotalHits should be set", 10, searchParameters.getTrackTotalHits());
     }
 
     @Test

repository/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>20.155</version>
+        <version>21.18</version>
     </parent>
 
     <dependencies>

repository/src/main/java/org/alfresco/repo/policy/TransactionBehaviourQueue.java

@@ -251,15 +251,16 @@ public class TransactionBehaviourQueue implements TransactionListener
         }
         catch (IllegalArgumentException e)
         {
-            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId(), e);
+            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId() + " : " + e.getMessage(), e);
         }
         catch (IllegalAccessException e)
         {
-            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId(), e);
+            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId() + " : " + e.getMessage(), e);
         }
         catch (InvocationTargetException e)
         {
-            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId(), e.getTargetException());
+            String msg = e.getMessage() + (e.getTargetException() != null ? "(" + e.getTargetException().getMessage() + ")" : "");
+            throw new AlfrescoRuntimeException("Failed to execute transaction-level behaviour " + context.method + " in transaction " + AlfrescoTransactionSupport.getTransactionId() + " : " + msg, e.getTargetException());
         }
     }
     

repository/src/main/java/org/alfresco/repo/rendition2/RenditionService2Impl.java

@@ -514,15 +514,11 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
                         NodeRef renditionNode = getRenditionNode(sourceNodeRef, renditionName);
                         boolean createRenditionNode = renditionNode == null;
                         boolean sourceHasAspectRenditioned = nodeService.hasAspect(sourceNodeRef, RenditionModel.ASPECT_RENDITIONED);
-                        boolean sourceChanges = !sourceHasAspectRenditioned || createRenditionNode || transformInputStream == null;
                         try
                         {
-                            if (sourceChanges)
-                            {
-                                ruleService.disableRuleType(RuleType.UPDATE);
-                                behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
-                                behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
-                            }
+                            ruleService.disableRuleType(RuleType.UPDATE);
+                            behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
+                            behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
 
                             // If they do not exist create the rendition association and the rendition node.
                             if (createRenditionNode)
@@ -592,12 +588,9 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
                         }
                         finally
                         {
-                            if (sourceChanges)
-                            {
-                                behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
-                                behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
-                                ruleService.enableRuleType(RuleType.UPDATE);
-                            }
+                            behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
+                            behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
+                            ruleService.enableRuleType(RuleType.UPDATE);
                         }
                         return null;
                     }, false, true));

repository/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceFacadeFactoryBean.java

@@ -57,6 +57,7 @@ import com.nimbusds.jose.proc.JWSVerificationKeySelector;
 import com.nimbusds.jose.proc.SecurityContext;
 import com.nimbusds.jose.util.ResourceRetriever;
 import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
+import com.nimbusds.oauth2.sdk.id.Issuer;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
 import org.alfresco.repo.security.authentication.identityservice.IdentityServiceFacade.IdentityServiceFacadeException;
@@ -88,7 +89,9 @@ import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
 import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
+import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
 import org.springframework.security.oauth2.core.OAuth2TokenValidator;
+import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
 import org.springframework.security.oauth2.core.converter.ClaimTypeConverter;
 import org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter;
 import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
@@ -96,7 +99,6 @@ import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtClaimNames;
 import org.springframework.security.oauth2.jwt.JwtClaimValidator;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
-import org.springframework.security.oauth2.jwt.JwtIssuerValidator;
 import org.springframework.security.oauth2.jwt.JwtTimestampValidator;
 import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.web.client.RestOperations;
@@ -361,12 +363,18 @@ public class IdentityServiceFacadeFactoryBean implements FactoryBean<IdentitySer
                                            .map(OIDCProviderMetadata::getAuthorizationEndpointURI)
                                            .map(URI::toASCIIString)
                                            .orElse(null);
+
+            final String issuerUri = Optional.of(metadata)
+                    .map(OIDCProviderMetadata::getIssuer)
+                    .map(Issuer::getValue)
+                    .orElseGet(config::getIssuerUrl);
+
             return ClientRegistration
                     .withRegistrationId("ids")
                     .authorizationUri(authUri)
                     .tokenUri(metadata.getTokenEndpointURI().toASCIIString())
                     .jwkSetUri(metadata.getJWKSetURI().toASCIIString())
-                    .issuerUri(config.getIssuerUrl())
+                    .issuerUri(issuerUri)
                     .authorizationGrantType(AuthorizationGrantType.PASSWORD);
         }
 
@@ -551,6 +559,34 @@ public class IdentityServiceFacadeFactoryBean implements FactoryBean<IdentitySer
         }
     }
 
+    static class JwtIssuerValidator implements OAuth2TokenValidator<Jwt>
+    {
+        private final String requiredIssuer;
+
+        public JwtIssuerValidator(String issuer)
+        {
+            this.requiredIssuer = requireNonNull(issuer, "issuer cannot be null");
+        }
+
+        @Override
+        public OAuth2TokenValidatorResult validate(Jwt token)
+        {
+            requireNonNull(token, "token cannot be null");
+            final Object issuer = token.getClaim(JwtClaimNames.ISS);
+            if (issuer != null && requiredIssuer.equals(issuer.toString()))
+            {
+                return OAuth2TokenValidatorResult.success();
+            }
+
+            final OAuth2Error error = new OAuth2Error(
+                    OAuth2ErrorCodes.INVALID_TOKEN,
+                    String.format("The iss claim is not valid. Expected `%s` but got `%s`.", requiredIssuer, issuer),
+                    "https://tools.ietf.org/html/rfc6750#section-3.1");
+            return OAuth2TokenValidatorResult.failure(error);
+        }
+
+    }
+
     private static boolean isDefined(String value)
     {
         return value != null && !value.isBlank();

repository/src/main/java/org/alfresco/repo/security/sync/ldap/LDAPUserRegistry.java

@@ -1605,8 +1605,6 @@ public class LDAPUserRegistry implements UserRegistry, LDAPNameResolver, Initial
                     this.userSearchCtls = new SearchControls();
                     this.userSearchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
                     this.userSearchCtls.setReturningAttributes(LDAPUserRegistry.this.userKeys.getFirst());
-                    // MNT-14001 fix, set search limit to ensure that server will not return more search results then provided by paged result control
-                    this.userSearchCtls.setCountLimit(LDAPUserRegistry.this.queryBatchSize > 0 ? LDAPUserRegistry.this.queryBatchSize : 0);
 
                     this.next = fetchNext();
                 }

repository/src/main/java/org/alfresco/repo/workflow/WorkflowServiceImpl.java

@@ -997,6 +997,20 @@ public class WorkflowServiceImpl implements WorkflowService
     public WorkflowTask updateTask(String taskId, Map<QName, Serializable> properties, Map<QName, List<NodeRef>> add,
                 Map<QName, List<NodeRef>> remove)
     {
+    	if(properties.containsKey(WorkflowModel.PROP_STATUS)) {
+
+            LinkedList<String> validTaskStatus = new LinkedList<>();
+            validTaskStatus.add("Not Yet Started");
+            validTaskStatus.add("In Progress");
+            validTaskStatus.add("On Hold");
+            validTaskStatus.add("Cancelled");
+            validTaskStatus.add("Completed");
+
+            if (!validTaskStatus.contains(properties.get(WorkflowModel.PROP_STATUS))) {
+                throw new WorkflowException("Invalid Value is Passed for Task Status.");
+            }
+        }
+	
         String engineId = BPMEngineRegistry.getEngineId(taskId);
         TaskComponent component = getTaskComponent(engineId);
         // get the current assignee before updating the task

repository/src/main/resources/alfresco/repository.properties

@@ -3,7 +3,7 @@
 repository.name=Main Repository
 
 # Schema number
-version.schema=18000
+version.schema=18100
 
 # Directory configuration
 
@@ -754,13 +754,6 @@ encryption.ssl.truststore.keyMetaData.location=
 httpclient.config.transform.mTLSEnabled=false
 httpclient.config.transform.maxTotalConnections=20
 httpclient.config.transform.maxHostConnections=20
-httpclient.config.transform.socketTimeout=5000
-httpclient.config.transform.connectionRequestTimeout=5000
-httpclient.config.transform.connectionTimeout=5000
-
-# Property is disabled by default for security reasons, never enable it on for production environments.
-# It will stop verification of hostnames placed in certificates returned with server responses to Repository requests towards transform services
-httpclient.config.transform.hostnameVerificationDisabled=false
 
 # Re-encryptor properties
 encryption.reencryptor.chunkSize=100
@@ -1349,7 +1342,7 @@ system.remove-alf_server-table-from-db.ignored=true
 allow.unsecure.callback.jsonp=false
 
 # pre-configured allow list of media/mime types to allow inline instead of attachment (via Content-Disposition response header)
-content.nonAttach.mimetypes=application/pdf,image/jpeg,image/gif,image/png,image/tiff,image/bmp
+content.nonAttach.mimetypes=application/pdf,image/jpeg,image/gif,image/png,image/tiff,image/bmp,application/octet-stream
 
 # Zip file compression ratio threshold as a percentage, above which the zip file will be considered a "zip bomb" and the
 # import extraction process cancelled.

repository/src/test/java/org/alfresco/repo/rendition2/RenditionService2IntegrationTest.java

@@ -30,6 +30,7 @@ import static org.junit.Assert.assertNotEquals;
 
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
+import java.util.ArrayList;
 import java.util.List;
 
 import org.alfresco.model.ContentModel;
@@ -419,6 +420,65 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
         assertTrue("New rendition content hash code was not generated", isValidRenditionContentHashCode(contentHashCode3));
     }
 
+    @Test
+    public void testModifierAfterMultipleRenditionRequests() throws InterruptedException
+    {
+        String user1 = createRandomUser();
+        String user2 = createRandomUser();
+        List<NodeRef> nodes = new ArrayList<NodeRef>();
+
+        final int TOTAL_NODES = 10;
+
+        // Create nodes
+        for (int i = 0; i < TOTAL_NODES; i++)
+        {
+            NodeRef n = createSource(user1, "quick.jpg");
+            render(user1, n, DOC_LIB);
+            nodes.add(n);
+        }
+
+        // Ask rendition multiple times with 'user2'
+        for (int j = 0; j < 10; j++)
+        {
+            for (int i = 0; i < TOTAL_NODES; i++)
+            {
+                render(user2, nodes.get(i), DOC_LIB);
+            }
+        }
+
+        for (int i = 0; i < TOTAL_NODES; i++)
+        {
+            waitForRendition(user1, nodes.get(i), DOC_LIB, true);
+        }
+
+        // Check the modifier is still user1
+        assertEquals(TOTAL_NODES, countModifier(nodes, user1));
+    }
+
+    private int countModifier(List<NodeRef> nodes, String user)
+    {
+        int count = 0;
+        for (int i = 0; i < nodes.size(); i++)
+        {
+            count += compareModifier(nodes.get(i), user);
+        }
+        return count;
+    }
+
+    private int compareModifier(NodeRef nodeRef, String user)
+    {
+        int res = 0;
+        if (nodeRef != null && user != null)
+        {
+            String modifier = nodeService.getProperty(nodeRef, ContentModel.PROP_MODIFIER).toString();
+            if (user.equals(modifier))
+            {
+                res = 1;
+            }
+        }
+        return res;
+    }
+
     /**
      * @deprecated can be removed when we remove the original RenditionService
      */
@@ -622,4 +682,4 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
             renditionService2.setEnabled(true);
         }
     }
-}
+}

repository/src/test/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceFacadeFactoryBeanTest.java

@@ -31,15 +31,20 @@ import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 import java.util.Map;
+import java.util.UUID;
 
 import org.alfresco.repo.security.authentication.identityservice.IdentityServiceFacadeFactoryBean.JwtDecoderProvider;
+import org.alfresco.repo.security.authentication.identityservice.IdentityServiceFacadeFactoryBean.JwtIssuerValidator;
 import org.junit.Test;
 import org.springframework.security.oauth2.client.registration.ClientRegistration.ProviderDetails;
+import org.springframework.security.oauth2.core.OAuth2Error;
+import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 
 public class IdentityServiceFacadeFactoryBeanTest
 {
+    private static final String EXPECTED_ISSUER = "expected-issuer";
     @Test
     public void shouldCreateJwtDecoderWithoutIDSWhenPublicKeyIsProvided()
     {
@@ -62,4 +67,53 @@ public class IdentityServiceFacadeFactoryBeanTest
                           .containsEntry(USERNAME_CLAIM, "piotrek");
     }
 
+    @Test
+    public void shouldFailWithNotMatchingIssuerURIs()
+    {
+        final JwtIssuerValidator issuerValidator = new JwtIssuerValidator(EXPECTED_ISSUER);
+
+        final OAuth2TokenValidatorResult validationResult = issuerValidator.validate(tokenWithIssuer("different-issuer"));
+        assertThat(validationResult).isNotNull();
+        assertThat(validationResult.hasErrors()).isTrue();
+        assertThat(validationResult.getErrors()).hasSize(1);
+
+        final OAuth2Error error = validationResult.getErrors().iterator().next();
+        assertThat(error).isNotNull();
+        assertThat(error.getDescription()).contains(EXPECTED_ISSUER, "different-issuer");
+    }
+
+    @Test
+    public void shouldFailWithNullIssuerURI()
+    {
+        final JwtIssuerValidator issuerValidator = new JwtIssuerValidator(EXPECTED_ISSUER);
+
+        final OAuth2TokenValidatorResult validationResult = issuerValidator.validate(tokenWithIssuer(null));
+        assertThat(validationResult).isNotNull();
+        assertThat(validationResult.hasErrors()).isTrue();
+        assertThat(validationResult.getErrors()).hasSize(1);
+
+        final OAuth2Error error = validationResult.getErrors().iterator().next();
+        assertThat(error).isNotNull();
+        assertThat(error.getDescription()).contains(EXPECTED_ISSUER, "null");
+    }
+
+    @Test
+    public void shouldSucceedWithMatchingIssuerURI()
+    {
+        final JwtIssuerValidator issuerValidator = new JwtIssuerValidator(EXPECTED_ISSUER);
+
+        final OAuth2TokenValidatorResult validationResult = issuerValidator.validate(tokenWithIssuer(EXPECTED_ISSUER));
+        assertThat(validationResult).isNotNull();
+        assertThat(validationResult.hasErrors()).isFalse();
+        assertThat(validationResult.getErrors()).isEmpty();
+    }
+
+    private Jwt tokenWithIssuer(String issuer)
+    {
+        return Jwt.withTokenValue(UUID.randomUUID().toString())
+                  .issuer(issuer)
+                  .header("JUST", "FOR TESTING")
+                  .build();
+    }
+
 }