fix for alfresco security issues

This reverts commit cc0955e012.

archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/__rootArtifactId__-platform-docker/src/main/docker/Dockerfile

@@ -14,10 +14,16 @@ RUN java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar install \
               $TOMCAT_DIR/amps $TOMCAT_DIR/webapps/alfresco -directory -nobackup -force
 
 COPY alfresco-global.properties $TOMCAT_DIR/shared/classes/alfresco-global.properties
-COPY dev-log4j2.properties $TOMCAT_DIR/shared/classes/alfresco/extension
+COPY dev-log4j2.properties $TOMCAT_DIR/shared/classes/alfresco/extension/dev-log4j2.properties
 COPY disable-webscript-caching-context.xml $TOMCAT_DIR/shared/classes/alfresco/extension
 
 # Copy Dockerfile to avoid an error if no license file exists
 COPY Dockerfile license/*.* $TOMCAT_DIR/webapps/alfresco/WEB-INF/classes/alfresco/extension/license/
 
+# Move the log file
+RUN sed -i -e "s_appender.rolling.fileName\=alfresco.log_appender.rolling.fileName\=${TOMCAT_DIR}/logs\/alfresco.log_" \
+        ${TOMCAT_DIR}/shared/classes/alfresco/extension/dev-log4j2.properties && \
+    sed -i -e "s_appender.rolling.filePattern=alfresco.log.%d{yyyy-MM-dd}_appender.rolling.filePattern\=${TOMCAT_DIR}/logs\/alfresco.log.%d{yyyy-MM-dd}_" \
+        ${TOMCAT_DIR}/shared/classes/alfresco/extension/dev-log4j2.properties
+
 USER ${USERNAME}

archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/__rootArtifactId__-platform-docker/src/main/docker/dev-log4j2.properties

@@ -1,19 +1,11 @@
-#set( $symbol_pound = '#' )
-#set( $symbol_dollar = '$' )
-#set( $symbol_escape = '\' )
-# Set root logger level to error
-#log4j2.rootLogger=error, Console, File
 rootLogger.level=error
 rootLogger.appenderRef.stdout.ref=ConsoleAppender
 rootLogger.appenderRef.rolling.ref=RollingAppender
 
-
 # All outputs currently set to be a ConsoleAppender.
 appender.console.type=Console
 appender.console.name=ConsoleAppender
 appender.console.layout.type=PatternLayout
-appender.console.layout.pattern=%d{ISO8601} %x %-5p [%c{3}] [%t] %replace{%m}{[\r\n]+}{}%n
-
 # use log4j NDC to replace %x with tenant domain / username
 appender.console.layout.pattern=%d{ISO8601} %x %-5p [%c{3}] [%t] %replace{%m}{[\r\n]+}{}%n
 
@@ -206,10 +198,6 @@ logger.alfresco-repo-node-db-NodeStringLengthWorker.level=info
 logger.alfresco-repo-workflow.name=org.alfresco.repo.workflow
 logger.alfresco-repo-workflow.level=info
 
-# CIFS server debugging
-logger.alfresco-smb.protocol.name=org.alfresco.smb.protocol
-logger.alfresco-smb.protocol.level=error
-
 # FTP server debugging
 logger.alfresco-ftp-protocol.name=org.alfresco.ftp.protocol
 logger.alfresco-ftp-protocol.level=error
@@ -368,7 +356,6 @@ logger.alfresco-repo-domain-schema-script-DeleteNotExistsExecutor.level=off
 logger.alfresco-repo-search-impl-solr-facet-SolrFacetServiceImpl.name=org.alfresco.repo.search.impl.solr.facet.SolrFacetServiceImpl
 logger.alfresco-repo-search-impl-solr-facet-SolrFacetServiceImpl.level=info
 
-
 # Bulk Filesystem Import Tool
 logger.alfresco-repo-bulkimport.name=org.alfresco.repo.bulkimport
 logger.alfresco-repo-bulkimport.level=warn
@@ -386,9 +373,6 @@ logger.alfresco-repo-content-metadata-AbstractMappingMetadataExtracter.level=war
 logger.apache-pdfbox-pdmodel-font-PDSimpleFont.name=org.apache.pdfbox.pdmodel.font.PDSimpleFont
 logger.apache-pdfbox-pdmodel-font-PDSimpleFont.level=fatal
 
-logger.apache-pdfbox-pdmodel-font-PDFont.name=org.apache.pdfbox.pdmodel.font.PDFont
-logger.apache-pdfbox-pdmodel-font-PDFont=fatal
-
 logger.apache-pdfbox-pdmodel-font-PDCIDFont.name=org.apache.pdfbox.pdmodel.font.PDCIDFont
 logger.apache-pdfbox-pdmodel-font-PDCIDFont.level=fatal
 
@@ -398,7 +382,6 @@ logger.alfresco-repo-search-impl-noindex-NoIndexIndexer.level=fatal
 
 logger.alfresco-repo-search-impl-noindex-NoIndexSearchService.name=org.alfresco.repo.search.impl.noindex.NoIndexSearchService
 logger.alfresco-repo-search-impl-noindex-NoIndexSearchService.level=fatal
-.
 
 # lucene index warnings
 logger.alfresco-repo-search-impl-lucene-index-IndexInfo.name=org.alfresco.repo.search.impl.lucene.index.IndexInfo
@@ -421,10 +404,9 @@ logger.alfresco-enterprise-repo-authorization-AuthorizationsConsistencyMonitor.l
 #-----------------------------------------------------------------------
 # Platform module logging
 #-----------------------------------------------------------------------
-logger.${package}-platformsample-DemoComponent.name=${package}.platformsample.DemoComponent
-logger.${package}-platformsample-DemoComponent.level=debug
-logger.${package}-platformsample-HelloWorldWebScript.name=${package}.platformsample.HelloWorldWebScript
-logger.${package}-platformsample-HelloWorldWebScript.level=debug
-
+logger.platformsample-DemoComponent.name=${package}.platformsample.DemoComponent
+logger.platformsample-DemoComponent.level=debug
+logger.platformsample-HelloWorldWebScript.name=${package}.platformsample.HelloWorldWebScript
+logger.platformsample-HelloWorldWebScript.level=debug
 
 

archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/__rootArtifactId__-platform/src/main/java/platformsample/DemoComponent.java

@@ -24,10 +24,8 @@ import org.alfresco.repo.module.AbstractModuleComponent;
 import org.alfresco.repo.nodelocator.NodeLocatorService;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.core.config.Configurator;
-import org.apache.logging.log4j.Level;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 /**
  * A basic component that will be started for this module.
@@ -38,7 +36,7 @@ import org.apache.logging.log4j.Level;
  * @author Maurizio Pillitu
  */
 public class DemoComponent extends AbstractModuleComponent {
-    private static Logger logger = LogManager.getLogger(DemoComponent.class);
+    private static Log logger = LogFactory.getLog(DemoComponent.class);
 
     private NodeService nodeService;
 
@@ -57,7 +55,6 @@ public class DemoComponent extends AbstractModuleComponent {
      */
     @Override
     protected void executeInternal() throws Throwable {
-        Configurator.setLevel(logger.getName(), Level.DEBUG);
         System.out.println("DemoComponent has been executed");
         logger.debug("Test debug logging. Congratulation your JAR Module is working");
         logger.info("This is only for information purposes. Better remove me from the log in Production");

archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/__rootArtifactId__-platform/src/main/java/platformsample/HelloWorldWebScript.java

@@ -24,11 +24,8 @@ import org.springframework.extensions.webscripts.Cache;
 import org.springframework.extensions.webscripts.DeclarativeWebScript;
 import org.springframework.extensions.webscripts.Status;
 import org.springframework.extensions.webscripts.WebScriptRequest;
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.core.config.Configurator;
-import org.apache.logging.log4j.Level;
-
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -40,14 +37,13 @@ import java.util.Map;
  * @since 2.1.0
  */
 public class HelloWorldWebScript extends DeclarativeWebScript {
-    private static Logger logger = LogManager.getLogger(HelloWorldWebScript.class);
+    private static Log logger = LogFactory.getLog(HelloWorldWebScript.class);
 
     protected Map<String, Object> executeImpl(
             WebScriptRequest req, Status status, Cache cache) {
         Map<String, Object> model = new HashMap<String, Object>();
         model.put("fromJava", "HelloFromJava");
 
-        Configurator.setLevel(logger.getName(), Level.DEBUG);
         logger.debug("Your 'Hello World' Web Script was called!");
 
         return model;

archetypes/alfresco-platform-jar-archetype/src/main/resources/archetype-resources/src/main/java/platformsample/DemoComponent.java

@@ -24,10 +24,8 @@ import org.alfresco.repo.module.AbstractModuleComponent;
 import org.alfresco.repo.nodelocator.NodeLocatorService;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.core.config.Configurator;
-import org.apache.logging.log4j.Level;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 /**
  * A basic component that will be started for this module.
@@ -38,7 +36,7 @@ import org.apache.logging.log4j.Level;
  * @author Maurizio Pillitu
  */
 public class DemoComponent extends AbstractModuleComponent {
-    private static Logger logger = LogManager.getLogger(DemoComponent.class);
+    private static Log logger = LogFactory.getLog(DemoComponent.class);
 
     private NodeService nodeService;
 
@@ -57,7 +55,6 @@ public class DemoComponent extends AbstractModuleComponent {
      */
     @Override
     protected void executeInternal() throws Throwable {
-        Configurator.setLevel(logger.getName(), Level.DEBUG);
         System.out.println("DemoComponent has been executed");
         logger.debug("Test debug logging. Congratulation your JAR Module is working");
         logger.info("This is only for information purposes. Better remove me from the log in Production");

archetypes/alfresco-platform-jar-archetype/src/main/resources/archetype-resources/src/main/java/platformsample/HelloWorldWebScript.java

@@ -24,10 +24,8 @@ import org.springframework.extensions.webscripts.Cache;
 import org.springframework.extensions.webscripts.DeclarativeWebScript;
 import org.springframework.extensions.webscripts.Status;
 import org.springframework.extensions.webscripts.WebScriptRequest;
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.core.config.Configurator;
-import org.apache.logging.log4j.Level;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -39,14 +37,13 @@ import java.util.Map;
  * @since 2.1.0
  */
 public class HelloWorldWebScript extends DeclarativeWebScript {
-    private static Logger logger = LogManager.getLogger(HelloWorldWebScript.class);
+    private static Log logger = LogFactory.getLog(HelloWorldWebScript.class);
 
     protected Map<String, Object> executeImpl(
             WebScriptRequest req, Status status, Cache cache) {
         Map<String, Object> model = new HashMap<String, Object>();
         model.put("fromJava", "HelloFromJava");
 
-        Configurator.setLevel(logger.getName(), Level.DEBUG);
         logger.debug("Your 'Hello World' Web Script was called!");
 
         return model;

plugins/alfresco-maven-plugin/pom.xml

@@ -92,7 +92,7 @@
         <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-archiver</artifactId>
-            <version>3.4</version>
+            <version>4.9.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
@@ -127,7 +127,12 @@
         <dependency>
             <groupId>org.alfrescolabs.alfresco-technical-validation</groupId>
             <artifactId>org.alfrescolabs.alfresco-technical-validation</artifactId>
-            <version>0.4.0</version>
+            <version>0.6.0</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-lang</groupId>
+            <artifactId>commons-lang</artifactId>
+            <version>2.6</version>
         </dependency>
         <dependency>
             <groupId>org.twdata.maven</groupId>