You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@rave.apache.org by "Raminderjeet Singh (Created) (JIRA)" <ji...@apache.org> on 2011/12/29 20:59:29 UTC
[jira] [Created] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Update widget Location in admin interface - Widget detail give Access is denied
-------------------------------------------------------------------------------
Key: RAVE-400
URL: https://issues.apache.org/jira/browse/RAVE-400
Project: Rave
Issue Type: Bug
Reporter: Raminderjeet Singh
If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Carl Hall (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178491#comment-13178491 ]
Carl Hall commented on RAVE-400:
--------------------------------
The 'afterInvocation' permission check performed by Spring after the widget is retrieved from widgetService.getWidgetByUrl(widget.getUrl()) fails. I've tracked this down to RavePermissionEvaluator.hasPermission. Checking the permission of the returned widget returns false because the widget found is null (null is expected for new URLs). RavePermissionEvaluator.hasPermission returns false for all checked permissions?
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Raminderjeet Singh resolved RAVE-400.
-------------------------------------
Resolution: Fixed
Updated WidgetService
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
> Assignee: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178761#comment-13178761 ]
Raminderjeet Singh commented on RAVE-400:
-----------------------------------------
Widget found check is to see if the widget is already registered and if i use existing widget its giving me right error. I dont think hasPermission should return false for new URL. I will look into to code to get better understanding. Similar validation checks would be in register new widget and it works there.
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Carl Hall (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178445#comment-13178445 ]
Carl Hall commented on RAVE-400:
--------------------------------
I'd love to work up a patch but don't have one yet. I want to make sure I understand the surround semantics before I submit a patch. Is this method not allowed by some defined method access logic somewhere? Would it be preferred to disabled editing of the URL, display an error message on edit or both?
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13185355#comment-13185355 ]
Raminderjeet Singh commented on RAVE-400:
-----------------------------------------
Finally found the problem and it was with @PostAuthorize("hasPermission(returnObject, 'read')") in WidgetService. If the Widget object is null hasPemission throws 403 Access is denied as described here https://jira.springsource.org/browse/SEC-1525. To fix this i need to change it to @PostAuthorize("returnObject == null or hasPermission(returnObject, 'read')") .
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
> Assignee: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178453#comment-13178453 ]
Raminderjeet Singh commented on RAVE-400:
-----------------------------------------
The UpdateWidgetValidator check is not working property for new URLs also. There will be some bug there. As of my understanding, Admis should be allowed to update the URL of existing gadgets as existing gadget link may be boken and if the new URL is not working request need to be redirected to error page. As a improvement, We need to update the metadata also according to new gadget. Look into add widget page for that.
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178436#comment-13178436 ]
Raminderjeet Singh commented on RAVE-400:
-----------------------------------------
Thanks Carl for digging into this. If you have solution to display a error message to the user that this is not allowed or to disable editing of URL in such cases please provide the patch.
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (RAVE-400) Update widget Location in
admin interface - Widget detail give Access is denied
Posted by "Carl Hall (Issue Comment Edited) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178491#comment-13178491 ]
Carl Hall edited comment on RAVE-400 at 1/3/12 1:55 AM:
--------------------------------------------------------
The 'afterInvocation' permission check performed by Spring after the widget is retrieved from widgetService.getWidgetByUrl(widget.getUrl()) fails. I've tracked this down to RavePermissionEvaluator.hasPermission. Checking the permission of the returned widget returns false because the widget found is null (null is expected for new URLs). Should RavePermissionEvaluator.hasPermission return false for all checked permissions on null objects?
was (Author: thecarlhall):
The 'afterInvocation' permission check performed by Spring after the widget is retrieved from widgetService.getWidgetByUrl(widget.getUrl()) fails. I've tracked this down to RavePermissionEvaluator.hasPermission. Checking the permission of the returned widget returns false because the widget found is null (null is expected for new URLs). RavePermissionEvaluator.hasPermission returns false for all checked permissions?
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Assigned] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Raminderjeet Singh (Assigned) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Raminderjeet Singh reassigned RAVE-400:
---------------------------------------
Assignee: Raminderjeet Singh
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
> Assignee: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (RAVE-400) Update widget Location in admin
interface - Widget detail give Access is denied
Posted by "Carl Hall (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/RAVE-400?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13178428#comment-13178428 ]
Carl Hall commented on RAVE-400:
--------------------------------
When the validation chain calls down to UpdateWidgetValidator.validateIfWidgetAlreadyExists, the call to widgetService.getWidgetByUrl hits Spring bean proxy code but is unable to call getWidgetByUrl (java.lang.reflect.InvocationTargetException).
> Update widget Location in admin interface - Widget detail give Access is denied
> -------------------------------------------------------------------------------
>
> Key: RAVE-400
> URL: https://issues.apache.org/jira/browse/RAVE-400
> Project: Rave
> Issue Type: Bug
> Reporter: Raminderjeet Singh
>
> If admin try to update Widget location HTTP Status 403 - Access is denied error is coming. Admin is allowed to update other fields
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira