Compare commits

...

27 Commits

Author SHA1 Message Date
alfresco-build
06d500311c [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-31 07:05:57 +00:00
alfresco-build
8d95ffc9ff [maven-release-plugin][skip ci] prepare release 23.3.0.86 2024-07-31 07:05:54 +00:00
varapathijanakiram
6e05d5d157 Merge pull request #2832 from Alfresco/feature/MNT-24400-Suggester-feature
Suggester feature in Share
2024-07-31 11:54:20 +05:30
vjanakiram
dfff72849d I have added bean 2024-07-29 21:17:30 +05:30
alfresco-build
d60172e860 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-28 00:07:08 +00:00
alfresco-build
3cac4e8206 [maven-release-plugin][skip ci] prepare release 23.3.0.85 2024-07-28 00:07:05 +00:00
Alfresco CI User
b35a64d14f [force] Force release for 2024-07-28. 2024-07-28 00:04:10 +00:00
alfresco-build
10e78191dd [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-25 21:03:12 +00:00
alfresco-build
6290c46d62 [maven-release-plugin][skip ci] prepare release 23.3.0.84 2024-07-25 21:03:09 +00:00
Tiago Salvado
8a61badabc [MNT-24513] Immutable user (IDS): allow to change enabled status (#2789)
* [MNT-24513] Immutable user: allow enabled status change

* [MNT-24513] Created 'allow.immutable.user.enabled.status.update' to control whether an immutabled user enabled status can be changed or not

* [MNT-24513] Regardless user details enabled status, the person nodeRef enabled status is also checked

* [MNT-24513] Prevent LDAP users from being disabled. Changed variable name.
2024-07-25 21:23:51 +01:00
alfresco-build
f9946827c4 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-24 13:18:42 +00:00
alfresco-build
b812c7856e [maven-release-plugin][skip ci] prepare release 23.3.0.83 2024-07-24 13:18:40 +00:00
Eva Vasques
a3f6e13a7c MNT-24503 - FixedAclUpdater Job - Skip count if maxSize is set (#2809) 2024-07-24 13:40:50 +01:00
alfresco-build
afffc7e870 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-24 05:54:22 +00:00
alfresco-build
fe5a01e2bd [maven-release-plugin][skip ci] prepare release 23.3.0.82 2024-07-24 05:54:20 +00:00
purusothaman-mm
03625565e9 [MNT-24292] fix for delete vulnerability (#2806) 2024-07-24 10:45:14 +05:30
alfresco-build
8d1d2b4f1b [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-23 11:55:48 +00:00
alfresco-build
1342c6a7bb [maven-release-plugin][skip ci] prepare release 23.3.0.81 2024-07-23 11:55:45 +00:00
Tom Page
17152b69fc Merge pull request #2807 from Alfresco/feature/PMD730
[skip tests] Upgrade ya-pmd-scan.
2024-07-23 12:43:50 +01:00
Tom Page
1a7027327e [skip tests] PRODENG-291 Upgrade ya-pmd-scan. 2024-07-23 12:17:46 +01:00
alfresco-build
7921969222 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-21 00:07:02 +00:00
alfresco-build
9cc93de7b2 [maven-release-plugin][skip ci] prepare release 23.3.0.80 2024-07-21 00:07:00 +00:00
Alfresco CI User
55c9cf3407 [force] Force release for 2024-07-21. 2024-07-21 00:04:10 +00:00
alfresco-build
120f45ba92 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-19 09:04:23 +00:00
alfresco-build
eacdbd3770 [maven-release-plugin][skip ci] prepare release 23.3.0.79 2024-07-19 09:04:21 +00:00
dependabot[bot]
93d4701d80 Bump dependency.cxf.version from 4.0.4 to 4.0.5 (#2794)
Bumps `dependency.cxf.version` from 4.0.4 to 4.0.5.

Updates `org.apache.cxf:cxf-rt-frontend-jaxws` from 4.0.4 to 4.0.5

Updates `org.apache.cxf:cxf-rt-frontend-jaxrs` from 4.0.4 to 4.0.5

Updates `org.apache.cxf:cxf-rt-rs-client` from 4.0.4 to 4.0.5

Updates `org.apache.cxf:cxf-rt-transports-http` from 4.0.4 to 4.0.5

Updates `org.apache.cxf:cxf-rt-ws-policy` from 4.0.4 to 4.0.5

---
updated-dependencies:
- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxws
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxrs
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.cxf:cxf-rt-rs-client
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.cxf:cxf-rt-transports-http
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.cxf:cxf-rt-ws-policy
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-19 10:22:28 +02:00
alfresco-build
64baf03818 [maven-release-plugin][skip ci] prepare for next development iteration 2024-07-18 08:49:23 +00:00
33 changed files with 151 additions and 43 deletions

View File

@@ -138,7 +138,7 @@ jobs:
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.35.2
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v1.35.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v1.35.2
- uses: Alfresco/ya-pmd-scan@v3.0.2
- uses: Alfresco/ya-pmd-scan@v4.0.0
with:
classpath-build-command: "mvn test-compile -ntp -Pags -pl \"-:alfresco-community-repo-docker\""

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-amps</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-governance-services-community-parent</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-governance-services-automation-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<build>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-governance-services-community-parent</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -125,7 +125,7 @@
parent="declarativeCapability">
<property name="name" value="DeleteRecordFolder"/>
<property name="private" value="true"/>
<property name="permission" value="CreateModifyDestroyFolders"/>
<property name="permission" value="DeleteRecords"/>
<property name="kinds">
<list>
<value>RECORD_FOLDER</value>

View File

@@ -8,7 +8,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-governance-services-community-repo-parent</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-governance-services-community-repo-parent</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<build>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -8,7 +8,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-amps</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<dependencies>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<dependencies>

View File

@@ -9,6 +9,6 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-packaging</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
</project>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-packaging</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -6,7 +6,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-packaging</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<modules>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-tests</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<organization>

View File

@@ -9,7 +9,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-tests</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<developers>

View File

@@ -9,7 +9,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-tests</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<developers>

View File

@@ -8,7 +8,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-tests</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -9,7 +9,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-tests</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<developers>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo-packaging</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<properties>

View File

@@ -2,7 +2,7 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
<packaging>pom</packaging>
<name>Alfresco Community Repo Parent</name>
@@ -61,7 +61,7 @@
<dependency.spring-security.version>6.3.1</dependency.spring-security.version>
<dependency.antlr.version>3.5.3</dependency.antlr.version>
<dependency.jackson.version>2.15.2</dependency.jackson.version>
<dependency.cxf.version>4.0.4</dependency.cxf.version>
<dependency.cxf.version>4.0.5</dependency.cxf.version>
<dependency.opencmis.version>1.0.0-jakarta-1</dependency.opencmis.version>
<dependency.webscripts.version>9.0</dependency.webscripts.version>
<dependency.bouncycastle.version>1.78.1</dependency.bouncycastle.version>
@@ -151,7 +151,7 @@
<connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
<developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
<url>https://github.com/Alfresco/alfresco-community-repo</url>
<tag>23.3.0.78</tag>
<tag>HEAD</tag>
</scm>
<distributionManagement>

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<dependencies>

View File

@@ -125,7 +125,7 @@ public class PeopleImpl implements People
protected ResetPasswordService resetPasswordService;
protected UserRegistrySynchronizer userRegistrySynchronizer;
protected Renditions renditions;
private Boolean allowImmutableEnabledUpdate;
private final static Map<String, QName> sort_params_to_qnames;
static
@@ -202,6 +202,11 @@ public class PeopleImpl implements People
this.userRegistrySynchronizer = userRegistrySynchronizer;
}
public void setAllowImmutableEnabledUpdate(Boolean allowImmutableEnabledUpdate)
{
this.allowImmutableEnabledUpdate = allowImmutableEnabledUpdate;
}
/**
* Validate, perform -me- substitution and canonicalize the person ID.
*
@@ -708,16 +713,26 @@ public class PeopleImpl implements People
// if requested, update password
updatePassword(isAdmin, personIdToUpdate, person);
if (person.isEnabled() != null)
Set<QName> immutableProperties = userRegistrySynchronizer.getPersonMappedProperties(personIdToUpdate);
Boolean isEnabled = person.isEnabled();
if (isEnabled != null)
{
if (isAdminAuthority(personIdToUpdate))
{
throw new PermissionDeniedException("Admin authority cannot be disabled.");
}
// note: if current user is not an admin then permission denied exception is thrown
MutableAuthenticationService mutableAuthenticationService = (MutableAuthenticationService) authenticationService;
mutableAuthenticationService.setAuthenticationEnabled(personIdToUpdate, person.isEnabled());
if (allowImmutableEnabledStatusUpdate(personIdToUpdate, isAdmin, immutableProperties))
{
LOGGER.info("User " + personIdToUpdate + " is immutable but enabled status will be set to: " + isEnabled);
}
else
{
// note: if current user is not an admin then permission denied exception is thrown
MutableAuthenticationService mutableAuthenticationService = (MutableAuthenticationService) authenticationService;
mutableAuthenticationService.setAuthenticationEnabled(personIdToUpdate, person.isEnabled());
}
}
NodeRef personNodeRef = personService.getPerson(personIdToUpdate, false);
@@ -742,9 +757,7 @@ public class PeopleImpl implements People
properties.putAll(nodes.mapToNodeProperties(customProps));
}
// MNT-21150 LDAP synced attributes can be changed using REST API
Set<QName> immutableProperties = userRegistrySynchronizer.getPersonMappedProperties(personIdToUpdate);
// MNT-21150 LDAP synced attributes can't be changed using REST API
immutableProperties.forEach(immutableProperty -> {
if (properties.containsKey(immutableProperty))
{
@@ -768,6 +781,28 @@ public class PeopleImpl implements People
return getPerson(personId);
}
private boolean allowImmutableEnabledStatusUpdate(String userId, boolean isAdmin, Set<QName> immutableProperties)
{
if (allowImmutableEnabledUpdate)
{
boolean containLdapUserAccountStatus = false;
QName propertyNameToCheck = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "userAccountStatusProperty");
for (QName immutableProperty : immutableProperties)
{
if (immutableProperty.equals(propertyNameToCheck))
{
containLdapUserAccountStatus = true;
break;
}
}
return isAdmin && !containLdapUserAccountStatus && !isMutableAuthority(userId);
}
return false;
}
private boolean checkCurrentUserOrAdmin(String personId)
{
boolean isAdmin = isAdminAuthority();

View File

@@ -764,6 +764,7 @@
<property name="thumbnailService" ref="ThumbnailService" />
<property name="resetPasswordService" ref="resetPasswordService" />
<property name="userRegistrySynchronizer" ref="userRegistrySynchronizer" />
<property name="allowImmutableEnabledUpdate" value="${allow.immutable.user.enabled.status.update}" />
</bean>
<bean id="People" class="org.springframework.aop.framework.ProxyFactoryBean">

View File

@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-community-repo</artifactId>
<version>23.3.0.78</version>
<version>23.3.0.87-SNAPSHOT</version>
</parent>
<dependencies>

View File

@@ -235,6 +235,11 @@ public class FixedAclUpdater extends TransactionListenerAdapter implements Appli
int countNodesWithAspects()
{
if (maxItems < DEFAULT_MAX_ITEMS) {
log.info("Job limited to process a maximum of " + maxItems + " Pending Acls");
return maxItems;
}
final CountNodesWithAspectCallback countNodesCallback = new CountNodesWithAspectCallback();
int count = transactionService.getRetryingTransactionHelper()
.doInTransaction(new RetryingTransactionCallback<Integer>()
@@ -246,12 +251,6 @@ public class FixedAclUpdater extends TransactionListenerAdapter implements Appli
return countNodesCallback.getCount();
}
}, false, true);
if (count > maxItems)
{
log.info("Total nodes with pending acl: " + count + " Limiting work to " + maxItems);
return maxItems;
}
return count;
}
}

View File

@@ -36,7 +36,11 @@ import net.sf.acegisecurity.UserDetails;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import net.sf.acegisecurity.providers.dao.User;
import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
import org.alfresco.repo.tenant.TenantService;
import org.alfresco.service.cmr.security.AuthenticationService;
import org.alfresco.service.cmr.security.MutableAuthenticationService;
import org.alfresco.service.cmr.security.PersonService;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -49,12 +53,30 @@ public class AuthenticationContextImpl implements AuthenticationContext
private final Log logger = LogFactory.getLog(getClass());
private TenantService tenantService;
private PersonService personService;
private AuthenticationService authenticationService;
private Boolean allowImmutableEnabledUpdate;
public void setTenantService(TenantService tenantService)
{
this.tenantService = tenantService;
}
public void setPersonService(PersonService personService)
{
this.personService = personService;
}
public void setAuthenticationService(AuthenticationService authenticationService)
{
this.authenticationService = authenticationService;
}
public void setAllowImmutableEnabledUpdate(Boolean allowImmutableEnabledUpdate)
{
this.allowImmutableEnabledUpdate = allowImmutableEnabledUpdate;
}
/**
* Explicitly set the given validated user details to be authenticated.
*
@@ -70,7 +92,7 @@ public class AuthenticationContextImpl implements AuthenticationContext
{
// Apply the same validation that ACEGI would have to the user details - we may be going through a 'back
// door'.
if (!ud.isEnabled())
if (isDisabled(userId, ud))
{
throw new DisabledException("User is disabled");
}
@@ -114,6 +136,43 @@ public class AuthenticationContextImpl implements AuthenticationContext
}
}
private boolean isDisabled(String userId, UserDetails ud)
{
boolean isDisabled = !ud.isEnabled();
boolean isSystemUser = isSystemUserName(userId);
if (allowImmutableEnabledUpdate && !isSystemUser)
{
try
{
boolean isImmutable = isImmutableAuthority(userId);
boolean isPersonEnabled = personService.isEnabled(userId);
isDisabled = isDisabled || (isImmutable && !isPersonEnabled);
}
catch (Exception e)
{
if (logger.isWarnEnabled())
{
logger.warn("Failed to determine if person is enabled: " + userId + ", using user details status: " + isDisabled);
}
}
}
return isDisabled;
}
private boolean isImmutableAuthority(String authorityName)
{
return AuthenticationUtil.runAsSystem(new RunAsWork<Boolean>()
{
@Override public Boolean doWork() throws Exception
{
MutableAuthenticationService mutableAuthenticationService = (MutableAuthenticationService) authenticationService;
return !mutableAuthenticationService.isAuthenticationMutable(authorityName);
}
});
}
public Authentication setSystemUserAsCurrentUser()
{
return setSystemUserAsCurrentUser(TenantService.DEFAULT_DOMAIN);

View File

@@ -274,6 +274,15 @@
<property name="tenantService">
<ref bean="tenantService" />
</property>
<property name="personService">
<ref bean="personService" />
</property>
<property name="authenticationService">
<ref bean="AuthenticationService" />
</property>
<property name="allowImmutableEnabledUpdate">
<value>${allow.immutable.user.enabled.status.update}</value>
</property>
</bean>
<!-- Simple Authentication component that rejects all authentication requests -->

View File

@@ -1342,6 +1342,8 @@
</property>
</bean>
<bean id="search.suggesterService" class="org.alfresco.repo.search.impl.DummySuggesterServiceImpl">
</bean>
<!-- Custom property editors -->
<bean class="org.springframework.beans.factory.config.CustomEditorConfigurer">
<property name="propertyEditorRegistrars">

View File

@@ -435,6 +435,9 @@ repo.remote.endpoint=/service
# persisted.
create.missing.people=${server.transaction.allow-writes}
# Allow an immutable user to have its enabled status changed
allow.immutable.user.enabled.status.update=false
# Create home folders (unless disabled, see next property) as people are created (true) or create them lazily (false)
home.folder.creation.eager=true
# Disable home folder creation - if true then home folders are not created (neither eagerly nor lazily)