Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-2527

Fix security issue in local session

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 5.1.5
    • Fix Version/s: 5.1.6
    • Component/s: Core
    • Upgrade notes:
      Hide

      This issue only applies to unit tests:
      When test code needs to open a session with administrator, username must be added explicitely in session context when opening it. For instance:
      // opening a system session
      Framework.login();
      RepositoryManager manager = Framework.getService(RepositoryManager.class);
      Map<String, Serializable> context = new HashMap<String, Serializable>();
      context.put("username", "system");
      coreSession = manager.getRepository(repo).open(context);

      Show
      This issue only applies to unit tests: When test code needs to open a session with administrator, username must be added explicitely in session context when opening it. For instance: // opening a system session Framework.login(); RepositoryManager manager = Framework.getService(RepositoryManager.class); Map<String, Serializable> context = new HashMap<String, Serializable>(); context.put("username", "system"); coreSession = manager.getRepository(repo).open(context);

      Description

      When creating a session without a principal, one named "Administrator" is used.

        Attachments

          Activity

            People

            • Assignee:
              atchertchian Anahide Tchertchian
              Reporter:
              atchertchian Anahide Tchertchian
              Participants:
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: