Bug 1136743 - dashbuilder requires 'root' user instead of admin role for some operations
Summary: dashbuilder requires 'root' user instead of admin role for some operations
Keywords:
Status: CLOSED EOL
Alias: None
Product: JBoss BPMS Platform 6
Classification: Retired
Component: BAM
Version: 6.0.2
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ER3
: 6.1.0
Assignee: David Gutierrez
QA Contact: Gui Jospin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-09-03 08:27 UTC by Toshiya Kobayashi
Modified: 2020-03-27 20:07 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-03-27 20:07:00 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Toshiya Kobayashi 2014-09-03 08:27:18 UTC
Description of problem:

When you upload Graphic resources like Envelope, you will get an error message "The zip file contains potentially insecure jsp's. Please use jsp's with only HTML and tags, or log in as root." even if you are logged in as an admin user (e.g. bpmsAdmin).

Steps to Reproduce:
1. log in to business-central as admin (e.g. bpmsAdmin)
2. Go to [Dashboards]->[Business Dashboards]
3. Go to configration [Graphic resources] -> [Envelope]
4. Download Default_Envelope.zip
5. Upload the Default_Envelope.zip with a different name

Actual results:

Get an error message "The zip file contains potentially insecure jsp's. Please use jsp's with only HTML and tags, or log in as root."

Expected results:

The Envelope is successfully added

Additional info:

If you create a user with username 'root' and role 'admin', you can work around the error.

Comment 3 David Gutierrez 2014-09-04 15:32:27 UTC
Indeed, this a known product limitation that should be removed. Anyone with the right privileges should be able to upload graphic resources.

Comment 4 Toshiya Kobayashi 2014-09-21 08:24:38 UTC
Work around:

A) Create a user with username 'root' and role 'admin'. Then login as the 'root' user.

or

B) Set your admin username to 2 system properties. "org.jboss.dashboard.users.UserStatus.rootLogin" and "org.jboss.dashboard.users.UserStatus.rootUserName"

for example) standalone.xml

    <system-properties>
...
        <property name="org.jboss.dashboard.users.UserStatus.rootLogin" value="bpmsAdmin"/>
        <property name="org.jboss.dashboard.users.UserStatus.rootUserName" value="bpmsAdmin"/>
    </system-properties>

Comment 5 David Gutierrez 2014-11-20 10:19:26 UTC
Fixed.

This constraint has been removed so that anyone with admnin privileges is able to upload graphic resources.

Github commit (master): https://github.com/droolsjbpm/dashboard-builder/commit/19b6aeeca3e5eebdcace8415dc971e06a9529005

Github commit (6.2.x): https://github.com/droolsjbpm/dashboard-builder/commit/e2170df4a9b96d6d92a1ed264b43302498cfd1ca

Comment 6 Jan Hrcek 2015-01-06 08:28:46 UTC
Ok, verified with BPM Suite 6.1.0 ER3.


Note You need to log in before you can comment on or make changes to this bug.