Secrets can not find the inode on certain url #27516

jdotcms · 2024-02-06T04:50:51Z

Parent Issue

No response

Problem Statement

Secrets tool can not parse url such as this: /data/shared/assets/c/e/ce837ff5-dc6f-427a-8f60-d18afc395be9/fileAsset/openai-summarize.vtl

In order to get the inode and realized if the last editor has permissions to retrieve the secret

Steps to Reproduce

Error reported on Auth, when accessing a page (using secrets) as an anon user, you get this error:

[05/02/24 22:33:57:468 GMT]  WARN servlets.BinaryExporterServlet: org.apache.catalina.connector.ClientAbortException: java.io.IOException: Broken pipe Error for = /contentAsset/raw-data/e4f816a6-e00d-42a7-acd4-b66b07c6bbae/asset/byInode/true

[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: Failed to find last modification user from Retrieved ID '' in URL Path '/data/shared/assets/c/e/ce837ff5-dc6f-427a-8f60-d18afc395be9/fileAsset/openai-summarize.vtl': begin 1, end -1, length 91
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: begin 1, end -1, length 91
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: java.base/java.lang.String.checkBoundsBeginEnd(String.java:3319)
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: Failed to evaluate Scripting Role presence: External scripting is disabled in your dotcms instance
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: External scripting is disabled in your dotcms instance
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: com.dotcms.rendering.velocity.viewtools.SecretTool.canUserEvaluate(SecretTool.java:142)
[05/02/24 22:34:07:997 GMT]  WARN viewtools.SecretTool: get External scripting is disabled in your dotcms instance @ url:GET//dotcms.com/testing/testing | lang:1 | ip:71.184.123.101 | Admin:false | start:02-02-2024 02:47:48 GMT >/LIVE/063474c6-6fb2-4ff1-80ca-85beb756e2fd/d1123bda-80c8-4f70-9d7a-e0b94f54033d.fields

[05/02/24 22:34:16:265 GMT]  INFO util.OpenAIRequest: Rate limit:3000/minute, or 1 every 20ms. Sleeping:19

[05/02/24 22:34:16:475 GMT]  INFO db.EmbeddingsDB: Saving embeddings for content:cache

In your local dotCMS instance, please do the following:

Go to the System > Apps portlet, click the Dot Velocity Secrets App, and click your current site -- default or demo.dotcms.com
Add two custom properties to the Velocity Secrets:
2.1 keyone with value Value for Key One.
2.2 keytwo with value Hidden Value for Key Two, and mark it as Hidden.
Create an Advanced Template with some HTML code that will display the secret values:

<html>
    <header>
        <title>My Custom Template</title>
    </header>
    <body>
        <h1>Welcome to my page!</h1>
        <div>
            <ul>
                <li>Key One = $dotsecrets.keyone</li>
                <li>Key Two = $dotsecrets.keytwo</li>
            </ul>
        </div>
    </body>
</html>

Create a test HTML Page using your Template.
View the test HTML Page in the front-end, and make sure you can se the value from both keyone and keytwo keys.
Now, create another test HTML Page, BUT log in as a limited User that DOES NOT have the Scripting Developer Role assigned to it.
You must not be able to see the value of the Secrets on the new test page.

Acceptance Criteria

The secrets should work ok

dotCMS Version

master

Proposed Objective

Core Features

Proposed Priority

Priority 3 - Average

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

The text was updated successfully, but these errors were encountered:

* #27516 fixing the way to capture the inode from an url * #27516 adding feedback * #27516 support other versionable cases

* 🏁 Publishing release version [24.01.26] * Setting to next version: [1.0.0-SNAPSHOT] * feat(core): Javascript Scripting API #26227 (#26230) * #26227 adding js engine + js script actionlet + js resource + js servlet. Still missing the graal real work, but most of the dot-boilerplate is kinda done * #26227 adding js engine + js script actionlet + js resource + js servlet. Still missing the graal real work, but most of the dot-boilerplate is kinda done * #26227 adding js engine + js script actionlet + js resource + js servlet. Still missing the graal real work, but most of the dot-boilerplate is kinda done * #26227 adding js engine + js script actionlet + js resource + js servlet. Still missing the graal real work, but most of the dot-boilerplate is kinda done * #26227 now at least compiles ok * #26227 wiring to the dotcms stack * #26227 seems now is kinda working * #26227 minor fix * #26227 adding the ability to print a template or payload return * #26227 now support a bit the request need to more a lot more to make it ok * #26227 moving to the dot-mozilla request * #26227 adding the js request and js context * #26227 adding the js request and js context * #26227 adding more elements to the context * #26227 some more enhacements for response * #26227 adding changes to handle diff results on the graaljs * #26277 adding view tools * #26227 working on proxies and js view tools * #26227 more proxy * #26277 the dotcontent js view tool may be done * #26227 adding the story block map proxy and other fixes * #26227 more changes to support worfklow on js view tools * #26227 now the fireEdit is kinda ready to test * #26227 adding archive * #26227 addding feedback * #26227 adding support for all system actions * #26227 fixes to support wf * #26227 adding the tags view tool; * #26227 adding the Tags and template js view tools * #26227 adding the latest js view tools * #26227 now the dotcache is working on js * #26227 adding the fetch * #26227 adding fetch functionality * #26227 compiling errors fixed * #26227 now the sources are being read from the file system and cache the contents in advance * #26227 now modules are kinda working * #26227 now user modules are working * finally cross site modules can be imported * #26227 adding some fixes * #26227 adding the last proxies by now * #26227 adding the content type api * #26227 adding more changes * $26227 adding error sintax handling * #26227 improving the error msg handling * #26227 adding more error handling * #26227 now the JSContent is being rendered properly * #26227 doc and minor improvements * #26227 adding unit test * #26227 adding unit test * #26227 testing the js engine * #26227 adding test * #26227 fixing dependencies * #26227 fixing dependencies * #26227 fixing unit test * #26227 fixing test * #26277 adding feedback * #26227 sonar feedback * #26277 sonarq feedback * #26277 sonarq feedback * #26277 sonarq feedback * #26277 sonarq feedback * #26227 removing temporaly the postman * #26227 fixing the postman test * #26227 Adding a change on the postman * #26227 now if can not read the modules nor functions, just avoid the loading * #26227 merging with master * #26227 refactoring the IT * #26227 feedback done * #26227 adding sonar feedback * #26227 sonarq fixes * #26227 sonarq fixes * #26227 sonarq fixes * Fixing label for announcements menu (#27464) * Added confirm dialog to replace existing asset name on File ContentType (#27466) * fix(apps): CSS issues #27445 (#27462) * Solved scroll apps card and avatar on Apps. WIP on scroll issue with textarea * Fixed css rules * sec(image) updating imageio libs to latest version (#27021) ref: #24853 * fix(push-publish): fix view all for bundles in publishing queue (#26170) * Update dotmarketing-config.properties (#26967) The `json.web.token.allowhttp` property had its default changed from `true` to `false` about a year ago, but the comment above it was not updated to match; it still seemed to imply a default of `true`, and encouraged users to change it in a production environment. This could lead to confusion, or worse! Co-authored-by: erickgonzalez <erick.gonzalez@dotcms.com> * "#26729 Removing typo in error message" (#27469) Co-authored-by: NeehaKethi <NeehaKethi@dotcms.com> * fix(core) #24307 : Fixing problem with Enterprise-only Metadata Providers not loading (#27470) * Update ApiToken_Resource.postman_collection.json (#26949) * Update ApiToken_Resource.postman_collection.json * Update ApiToken_Resource.postman_collection.json * Update ApiToken_Resource.postman_collection.json * Update TempAPI.postman_collection.json (#27053) * fix(CLI): Fixing and ignoring intermittent tests (#27481) * #26633 Refactor SitePushHandler and add SiteTestHelper The SitePushHandler class has been refactored to improve readability and maintainability. Helper methods have been introduced to decide whether a site should be published, archived or unpublished. The push handler now utilizes ScheduledExecutorService to handle potential delays in site status changes. Furthermore, SiteTestHelper has been introduced providing common utility functions for site related tests. * #26633 Refactor site testing and enhance site copying command Adjusted SiteCommandIT to ensure a site is created before invoking the copy command. The SiteCopy class's output now includes a note that the copy operation happens in the background. * #26633 Refactor finding site by name into a separate method * #26633 Handle received exceptions when getting site response The commit modifies the logic to handle the processing of responses when invoking the verifyAndReturnSiteAfterCompletion method for site pushing. It now makes use of Java's CompletableFuture.exceptionally method, which allows us to handle exceptions that occur in the previous stages of the pipeline. This change also included a minor adjustment to clarify the calculation for ending time in the Runnable task. * #26633 Disable intermittently failing tests in CLI module The commit marks a substantial number of tests as disabled due to intermittent failures. These tests span multiple files within the CLI module, across different functionalities such as pulling, pushing, and tree traversal. This temporary measure is taken to enable smoother CI runs, while these intermittent issues are being investigated and resolved. * #26633 Applying feedback removing Thread.sleep from code * #27451 Checking if the Experiment is still running before send the Ev… (#27475) * #27451 Checking if the Experiment is still running before send the Event to Jitsu * Making sonnar happy * feat(edit-content): #27289 Allow user to enable a new edit mode from the content types (#27477) * feat(edit content) #27289 : Add a button to the Content Type screen to enable the new edit mode * progress * fix conflicts of cherry picks * fix tests and add scenarios * clean up 1 * traductions * labels fix * fix conflicts of cherry picks --------- Co-authored-by: Humberto Morera <humberto.morera@dotcms.com> Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> * chore(core): Expose the `editableAsText` attribute, even if the metadata file doesn't have it yet #27393 (#27398) * fix(Edit Content) #27393 : Expose the `editableAsText` attribute even if the metadata file doesn't have it yet * Fixing Integration Test * Fixing `GraphQLTests.json` Postman Test --------- Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> * #26800 Adding GITHUB_TOKEN to checkout repo step. (#27495) * Updating some deprecated action versions. Co-authored-by: Daniel Colina <daniel.colina@dotcms.com> * #26900 Allow pass field variables to Monaco's Binary Field And JSON Field (#27388) * feat(edit-content) add to binary-field and json-field use custom FieldVariable of Monaco Editor * feat(edit-content) type fixes * Update core-web/libs/edit-content/src/lib/fields/dot-edit-content-binary-field/components/dot-binary-field-editor/dot-binary-field-editor.component.ts Make signal private. Co-authored-by: Rafael Velazco <rjvelazco21@gmail.com> * fix(edit-content) fix comments * fix(edit-content) add properties to sonarqube config --------- Co-authored-by: Rafael Velazco <rjvelazco21@gmail.com> * 🏁 Releasing version 1.0.0-SNAPSHOT * ⬆️ Next version 1.0.0-SNAPSHOT * chore(edit-ema): Change the nextjs example colors and theme #27425 (#27498) * chore(edit-ema): Clean up nextjs and app list porlet * Update clean up * Clean-up runner (#27504) * Clean-up runner * test * test * test * fix(announcements): adjust announcements menu icon size (#27496) * Adjust icons #27463 * #27463 Fix sizing * Adding noopener * feat(Announcements): correcting query that retrieves announcements from prod and fixing postman Ref:s#25736 (#27480) * #25736 the postman is set to create the CT taking into account the announcementDate as publish date * #25736 megre latest from master * #25736 allowing time for publishing to take effect * #25736 debugging postman failure * #25736 correcting announcements remote query * #25736 code clean up * #25736 updating postman test * #25736 url query fix * #25736 adjusting test * #25736 imrproved IT * #25736 log should be debug * chore(core): Update local.dotcms.site cert so that it is valid for 2024 (#27385) doing this in the correct file now #27384 (#27476) * task(ssl) update local.dotcms.site cert so that it is valid for 2024 (#27385) doing this in the correct file now. ref: #27384 * #27384 removing unused/duped tomcat directory * fix(ui): Fixed scroll on replace-name-dialog in File ContentType (#27509) * chore(core): Redis Improvements #26932 (#26974) * #26932 fixes for redis * #26932 now works locally * #26932 fixing a test issue --------- Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> * use: css variables (#27506) * feat(edit-content): Implement Key/Value Field #26904 (#27465) * dev: start refactor * dev: update DotKeyValueTableInputRow Component * dev: move DotKeyValue Component to ui library * dev: rename dot-key-value-ng to dot-key-value * clean up * revert: renaming * dev: fix DotKeyValueTableInputRow Component tests * dev: cover tests * dev: cover tests v2 * clean up * fix: SonarQube Consistency issue * clean up v2 * test: feedback v1 * dev: feedback v2 * clean up * fixed checkbox background issue (#27492) * fix(edit-content): Autocomplete component responsiveness #27421 (#27474) * fixed expand on tags * Changed selector on has() for SonarQube bug * Removed border * #27479 Adding Vanity URLs (#27515) * chore(sonar) new sonarqube requires java17 (#27529) * new sonarqube requires java17 * update the sonarqube client Change is only in build queue that is currently blocked due to SonarQube issue after upgrade. * feat(edit content): Add settings to Binary Field content type (#27455) * create binary settings component * make the formulary save and delete * add variables in settings to blacklist * apply settings to binary field * Update dot-edit-content-binary-field.component.scss * change divider color * add test cases * clean tests * add test cases * add translations * fix sonarq * add test cases * add test cases * Refactor, make PR suggestions * Fixed behavior when dont have value * Fixed getter, missed on merge * Removed unnecesary code --------- Co-authored-by: KevinDavilaDotCMS <144152756+KevinDavilaDotCMS@users.noreply.github.com> * #25736 qa wants postman to fail is we pass an invalid CT (#27520) * feat(CLI): #27416 Adding GHA release CLI workflow steps for publishing binaries into NPM registry. (#27514) * #27416 Building NPM package before publishing. * #27416 Building NPM package before publishing. Testing. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +1. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +2. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +3. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +4. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +5. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +6. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +7. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +8. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +8. * #27416 Building NPM package before publishing. Testing Jinja2 rendering. +9. * #27416 Testing build package. * #27416 Improving artifact composition. * #27416 Testing package composition. * #27416 Fixing set up package name and package version. * #27416 Fixing set up package name and package version. +1. * #27416 Fixing set up package name and package version. +2. * #27416 Testing package composition. +1. * #27416 Fixing package composition. * #27416 Testing prepare package content step. * #27416 Some improvements over the CLI release workflow. * #27416 Generating rc suffix to NPM package when release SNAPSHOT version. * #27416 Testing package structure. * #27416 Checking package.json file configuration. * #27416 Fixing workflow syntax. * #27416 Testing assembly configuration. * #27416 Fixing assembly configuration. * #27416 Testing assembly configuration. +1. * #27416 Testing assembly configuration. * #27416 Some improvements on packaging process. * #27416 Setting project name into package.json file. * #27416 Preparing package.json file. * #27416 Fixing package.json file. * #27416 Fixing some package composition failures. * #27416 Workflow commit messages changed. * #27416 NPM package tagging improvements. * #27416 Testing package version number resolution. * #27416 Refactoring NPM_PACKAGE_VERSION resolution. * #27416 Fixing package version generation. * #27416 Fixing NPM package version generation. * #27416 Fixing NPM package version generation. +1. * #27416 Fixing NPM package version generation. +2. * #27416 Fixing NPM package version generation. +3. * #27416 Fixing NPM package version generation. +4. * #27416 Fixing NPM package version generation. +5. * #27416 Ready to test the whole process. * #27416 Uncomment an important instruction for NPM package set up. * #27416 NPM_PACKAGE_NAME fixed. --------- Co-authored-by: Daniel Colina <daniel.colina@dotcms.com> * #27516 fixing the way to capture the inode from an url (#27517) * #27516 fixing the way to capture the inode from an url * #27516 adding feedback * #27516 support other versionable cases * 🏁 Releasing CLI version 24.01.26 * ⬆️ Next CLI version 1.0.0-SNAPSHOT * Removing metric code from core (#27485) * First revert * second revert * Reverting Metric changes on core * Removing * #27451 Checking if the Experiment is still running before send the Event to Jitsu * Making sonnar happy * getting some changes back * reverting 94fe49b * fix(hosts) now sorts from shortest to longest. Also removed a bad join for live+working sites (#27497) ref: #27447 Co-authored-by: Jose Castro <jose.castro@dotcms.com> Co-authored-by: Nollymar Longa <nollymar.longa@dotcms.com> * fix(edit-content): Adding multiple binary fields in Content Type breaks the model #27523 (#27533) * dev: fix registered dojo id error * dev: fix DotContentletThumbnail Web Component * clean up --------- Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> * #27522 Unable to edit content from Card view in content Search (#27524) * add contentType param + clickable label * send contentType correctly and update test * cover event content type and click on thumbnail in table listing --------- Co-authored-by: Arcadio Quintero <oidacra@gmail.com> * Fixed autocomplete as dropdown and multiple options (#27532) Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> Co-authored-by: Jalinson Diaz <zjaaaldev@gmail.com> * fix(sites) adding secondary sort on hostname, so now sorting sites by shortest, then hostname. (#27550) ref: #27447 * Update Permission_Resource.postman_collection.json (#26947) * Update Permission_Resource.postman_collection.json * Update Permission_Resource.postman_collection.json * fix(announcements): menu item mark as read (#27548) * #27494 Implement mark as read * #27494 Adding announcement test has been read test * removing space * Fix test * chore(security): Upgrading Tomcat to latest minor release 9.0.85 #26722 (#27512) * sec(core) #26722 : Upgrading Tomcat to latest minor release 9.0.85 * Update server.xml Removing XML comment from debug process, reported via Code Review. * need to cleanup runner due to out of disk space (#27566) * #27453 Include Experience plugin as dependency (#27543) * #27453 Include Experience plugin as dependency * feedback * Update Scripting_Resource.postman_collection.json (#26950) * Update Scripting_Resource.postman_collection.json * Update Scripting_Resource.postman_collection.json * Update Scripting_Resource.postman_collection.json * Update Scripting_Resource.postman_collection.json --------- Co-authored-by: Mehdi <10160868+mbiuki@users.noreply.github.com> * Update BringBack.postman_collection.json (#26948) * Update BringBack.postman_collection.json * Update BringBack.postman_collection.json * Update BringBack.postman_collection.json * Update BringBack.postman_collection.json --------- Co-authored-by: Mehdi <10160868+mbiuki@users.noreply.github.com> * need to run cleanup after checkout (#27567) * fix(edit-ema): Fixed behaviour on select contentlet (#27560) --------- Co-authored-by: dotCMS-Machine-User <dotCMS-Machine-User@dotcms.com> Co-authored-by: Jonathan <jonathan.sanchez@dotcms.com> Co-authored-by: Manuel Rojas <manuel.rojas.21@gmail.com> Co-authored-by: Kevin Davila <144152756+KevinDavilaDotCMS@users.noreply.github.com> Co-authored-by: Will Ezell <will@dotcms.com> Co-authored-by: Jamie Mauro <102264829+jdcmsd@users.noreply.github.com> Co-authored-by: erickgonzalez <erick.gonzalez@dotcms.com> Co-authored-by: Neehakethi-dotcms <139247809+Neehakethi@users.noreply.github.com> Co-authored-by: NeehaKethi <NeehaKethi@dotcms.com> Co-authored-by: Jose Castro <jose.castro@dotcms.com> Co-authored-by: Rashik Adhikari <128124382+rashik1144@users.noreply.github.com> Co-authored-by: Jonathan Gamba <jonathan.gamba@dotcms.com> Co-authored-by: freddyDOTCMS <147462678+freddyDOTCMS@users.noreply.github.com> Co-authored-by: Humberto Morera <humberto.morera@dotcms.com> Co-authored-by: Freddy Montes <751424+fmontes@users.noreply.github.com> Co-authored-by: Daniel Enrique Colina Rodríguez <danielcolina@gmail.com> Co-authored-by: Daniel Colina <daniel.colina@dotcms.com> Co-authored-by: Arcadio Quintero <oidacra@gmail.com> Co-authored-by: Rafael Velazco <rjvelazco21@gmail.com> Co-authored-by: Victor Alfaro <victor.alfaro@dotcms.com> Co-authored-by: Fabrizzio Araya <37148755+fabrizzio-dotCMS@users.noreply.github.com> Co-authored-by: spbolton <steve.bolton@dotcms.com> Co-authored-by: Jalinson Diaz <zjaaaldev@gmail.com> Co-authored-by: Nollymar Longa <nollymar.longa@dotcms.com> Co-authored-by: Humberto Morera <31667212+hmoreras@users.noreply.github.com> Co-authored-by: Mehdi <10160868+mbiuki@users.noreply.github.com>

jcastro-dotcms · 2024-02-23T17:17:12Z

INTERNAL QA: PASSED

A page created by a User with the expected Scripting Developer Role can now display secrets without issues, and no errors are displayed in the log.

josemejias11 · 2024-02-26T15:05:13Z

Failed: Tested on master_62e8d60, Docker, macOS 13.0, FF v121.0.1

I see this is still happening

jdotcms · 2024-03-08T05:25:57Z

hi @josemejias11 could you please add the steps to reproduce it

fmontes · 2024-03-11T15:54:50Z

@bryanboza any ideas here?

josemejias11 · 2024-03-13T17:57:52Z

Approved: Tested on master_909f9ce, Docker, macOS 13.0, FF v121.0.1

I was trying to reproduce this once again and I'm not able to do it so.

bryanboza · 2024-03-13T18:56:09Z

Ok, I tested this card and what I have we need some work here:

Following the provided steps, this is what I have...

Screen.Recording.2024-03-13.at.12.49.19.PM.mov

jdotcms · 2024-03-15T05:03:39Z

hi @bryanboza

Thanks for the feedback, unfortunately in your video I can not see 2 things:

the ttl for the testing page (I would recommend 0 to avoid caching issues)
the last modifier user for the template

I am wondering that, because the rules are the following:

a)

boolean hasScriptingRole = checkRoleFromLastModUser(scripting);

If the last mod user has scripting role it is enough to show the secrets, even if the current user does not have the scripting role or it is anonymous

b)

if (!hasScriptingRole) {
				final User user = WebAPILocator.getUserWebAPI().getUser(this.request);
				// try with the current user
				if (null != user) {
					hasScriptingRole = APILocator.getRoleAPI().doesUserHaveRole(user, scripting);
				}
			}

If the last mod user does not have the scripting role, then we check if the actual user has the scripting role permission

So, what I think is happening, is that the last user to modified the template was the admin, so the page is accesible for everyone in terms of secrets, I have debugged master and I can confirm that

bryanboza · 2024-03-19T19:11:48Z

Yes I tested modifying the template with the limited user and the same thing happens, and also I tested in a incognito mode to make sure that is not the browser cache and flushing the dotCMS caches too.

wezell · 2024-03-19T19:26:25Z

This is working on the demo site - take a look here, it is pulling the secrets. I think the user (admin?) you used to create the template does not have the scripting role?

https://demo.dotcms.com/testing-secrets

jdotcms · 2024-03-19T20:42:46Z

Per discussion with @bryanboza , it seems he tested/edit the template with Chris Publishi who does not have any script role
and then request the page associated to that template with the same Chris or Annonymous and was able to see the secrets

About to re-test the scenario

jdotcms · 2024-03-19T21:18:26Z

I have done the following test

have created an user with access to pages, templates, etc but without the scripting role
have created with admin user a template + page + secrets tools (admin of course has scripting role)
the page works fine even if the limited user is the one that request the page, of course admin works too.
get login as limited user
edit the template where I wrote the secrets tool code
looks such as this

get back again to the page and see, the secrets are not longer available b/c the latest upd user has not the role, and even the current one (which is the limited)

Note: if I logout as a Limited user and get back to admin, and re-open the page again (the one with the template with secrets), the secrets are available to see b/c even if the latest mod user has not the script role, the current user is admin and he has the script role

bryanboza · 2024-03-25T19:31:58Z

Fixed, after the discussion seems that this is ok for now!!!

Tested on master // Docker // FF

erickgonzalez · 2024-04-23T21:37:05Z

Only for 23.10 LTS

jdotcms added Type : Defect Triage labels Feb 6, 2024

jdotcms self-assigned this Feb 6, 2024

jdotcms added the Team : Lunik label Feb 6, 2024

jdotcms added a commit that referenced this issue Feb 6, 2024

#27516 fixing the way to capture the inode from an url

e0a02ce

jdotcms linked a pull request Feb 6, 2024 that will close this issue

#27516 fixing the way to capture the inode from an url #27517

Merged

jdotcms added a commit that referenced this issue Feb 6, 2024

#27516 adding feedback

6731a0e

jdotcms added a commit that referenced this issue Feb 7, 2024

#27516 support other versionable cases

85ea950

github-merge-queue bot pushed a commit that referenced this issue Feb 7, 2024

#27516 fixing the way to capture the inode from an url (#27517)

d13510e

* #27516 fixing the way to capture the inode from an url * #27516 adding feedback * #27516 support other versionable cases

wezell closed this as completed in #27517 Feb 7, 2024

dsolistorres pushed a commit that referenced this issue Feb 9, 2024

#27516 fixing the way to capture the inode from an url (#27517)

c7bc619

* #27516 fixing the way to capture the inode from an url * #27516 adding feedback * #27516 support other versionable cases

jcastro-dotcms reopened this Feb 23, 2024

jcastro-dotcms assigned jdotcms and jcastro-dotcms and unassigned jdotcms Feb 23, 2024

jcastro-dotcms added the QA : Passed Internal label Feb 23, 2024

josemejias11 added the Needs Work label Feb 26, 2024

josemejias11 added QA : Approved and removed Needs Work QA : Approved labels Mar 13, 2024

bryanboza added Needs Work and removed QA : Approved labels Mar 13, 2024

bryanboza added the Release : 24.03.22 Bug Fixing label Mar 13, 2024

fmontes removed the Needs Work label Mar 21, 2024

bryanboza added Release : 24.04.5 CLI and removed Release : 24.03.22 Bug Fixing labels Mar 25, 2024

bryanboza added the QA : Approved label Mar 25, 2024

fmontes closed this as completed Apr 16, 2024

erickgonzalez added LTS : Next Ticket that will be added to LTS Next LTS Release Shortlisted of issues that will be included in the upcoming LTS LTS: Excluded Ticket that has been excluded from at least one LTS and removed LTS : Next Ticket that will be added to LTS labels Apr 19, 2024

erickgonzalez added a commit that referenced this issue Apr 23, 2024

#27516 include in 23.10.24

1aee274

erickgonzalez added Release : 23.10.24 v9 Included in LTS patch release 23.10.24 v9 and removed Next LTS Release Shortlisted of issues that will be included in the upcoming LTS labels May 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secrets can not find the inode on certain url #27516

Secrets can not find the inode on certain url #27516

jdotcms commented Feb 6, 2024 •

edited by jcastro-dotcms

jcastro-dotcms commented Feb 23, 2024

josemejias11 commented Feb 26, 2024

jdotcms commented Mar 8, 2024

fmontes commented Mar 11, 2024

josemejias11 commented Mar 13, 2024

bryanboza commented Mar 13, 2024

jdotcms commented Mar 15, 2024 •

edited

bryanboza commented Mar 19, 2024

wezell commented Mar 19, 2024

jdotcms commented Mar 19, 2024

jdotcms commented Mar 19, 2024

bryanboza commented Mar 25, 2024

erickgonzalez commented Apr 23, 2024

Secrets can not find the inode on certain url #27516

Secrets can not find the inode on certain url #27516

Comments

jdotcms commented Feb 6, 2024 • edited by jcastro-dotcms

Parent Issue

Problem Statement

Steps to Reproduce

Acceptance Criteria

dotCMS Version

Proposed Objective

Proposed Priority

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

Assumptions & Initiation Needs

Quality Assurance Notes & Workarounds

Sub-Tasks & Estimates

jcastro-dotcms commented Feb 23, 2024

INTERNAL QA: PASSED

josemejias11 commented Feb 26, 2024

jdotcms commented Mar 8, 2024

fmontes commented Mar 11, 2024

josemejias11 commented Mar 13, 2024

bryanboza commented Mar 13, 2024

jdotcms commented Mar 15, 2024 • edited

bryanboza commented Mar 19, 2024

wezell commented Mar 19, 2024

jdotcms commented Mar 19, 2024

jdotcms commented Mar 19, 2024

bryanboza commented Mar 25, 2024

erickgonzalez commented Apr 23, 2024

jdotcms commented Feb 6, 2024 •

edited by jcastro-dotcms

jdotcms commented Mar 15, 2024 •

edited