#mitco solutions

[mitco]

Disabling inherited permissions on a Site causes the SiteManager to loose rights

It's been a while since I last posted something, that didn't mean I wasn't into Alfresco on the contrary I was too busy with Alfresco stuff to post ;).

So what's this issue all about??

The issue has to do with the permissions based on roles(SiteConsumer, SiteContributer,SiteCollaborator and SiteManager) handled and configured within Sites.

Within an Enterprise organisation it's not sufficient to group everyone within these roles. Most likely you'll have departments with their own access rights. E.g. there will be a group Finance department with a role SiteContributer.

So before you'll know it, the repository view will be used to set permissions. This is were the issue starts.

The following image is the default Site Manage Permissions view:

But we want to add the "Finance Department" group, so we need the Repository view "Manage Permissions":

So the normal way setting a permission will be the following:

Click on "Inherit Permissions" button to disable the current active permissions

Click on Add User/Group to add our "Finance Department"

Save

Which will result in the following:

Outside a site this is a proper permission-set but within a site this disables the Site Manager to have admin rights. So the Site Manager can't even fix the issue he/she has noticed afterwards :(.

So there are 3 solutions for this:

Use the default Site "Manage Permissions" View to first disable all the roles to have access. This will disable the "Inherit Permissions" and will add the SiteManager permission to the folder/content.

Write a Java Behaviour which will run on NodeServicePolicies.OnUpdatePropertiesPolicy and will add the SiteManager permission after inheritsPermissions() has been set to false.

Or like what I did, because I can't shutdown production for a while, is write a JavaScript which fires from the JavaScript-Console within Share

This is the piece of code I use after an issue is submitted:

var site = space; recurse(site.childByNamePath("documentLibrary"), function(node) {     if (!node.inheritsPermissions()) {         logger.log("BEFORE: " + node.getPermissions());         node.removePermission("SiteManager", "GROUP_site_" + site.name + "_SiteManager");         node.removePermission("SiteManager", "GROUP_" + site.name + "_SiteManager");         node.setPermission("SiteManager", "GROUP_site_" + site.name + "_SiteManager");         logger.log("AFTER: " + node.getPermissions());     } });

I've instructed all the Site Admin's to follow step 1 before changing permissions, but like always there are cases where users don't follow guide lines.

--- UPDATE ---

Alfresco opened a JIRA ticket: https://issues.alfresco.com/jira/browse/ALF-16522

[mitco]

When adding a node of type cm:folder to bpm_package (in e.g. a workflow) an incorrect URL gets generated through the template packageitems.ftl In packageitems.ftl at line 5 the following happens:

<#local documentLinkResolver>     function(item){         return Alfresco.util.siteURL("document-details?nodeRef=" + item.nodeRef, { site: item.site });     } </#local>

This should be:

<#local documentLinkResolver>     function(item){         if (item.isContainer)             return Alfresco.util.siteURL("folder-details?nodeRef=" + item.nodeRef, { site: item.site });         else             return Alfresco.util.siteURL("document-details?nodeRef=" + item.nodeRef, { site: item.site });     } </#local>

I've tested it against Alfresco 3.4x and now when adding a cm:folder to the bpm_package a correct URL gets generated.

[mitco]

Alfresco: How to access the Database for special querying, like retrieving the Unique Logins

Recently a client wanted something, which couldn't be retrieved from the normal Alfresco API. The data was present in Alfresco, I did a DB query and got the desired results, but now I wanted to present that in a Dashlet.

After doing some research, I finally found the way to do it.

I created a Java-Backed Webscript, like stated at the Alfresco Wiki.

That is quite easily done, the next step was to know which DB-class I needed to pick. I know that Alfresco uses Hibernate, so making a separate JDBC-connection is just stupid.

After struggling with different classes, I eventually found the right one. I need to extend my class from org.springframework.orm.hibernate3.support.HibernateDaoSupport

One can use HQL Queries or plain SQL.

Beginning with plain SQL I ended up doing more translations and comparisons than using HQL. It was sometimes a bit hard to creating the right Query, because for testing purposes I directly queried the DB. So re-writing SQL to HQL is something which can take a while.

This is an example class which queries directly the DB:

public class DBQuery extends HibernateDaoSupport {     public List<Object[]> getResultSet(final Date startDate, final Date endDate) {         HibernateCallback callback = new HibernateCallback() {             public Object doInHibernate(Session session) throws HibernateException, SQLException {                                 Date startQuery = null;                 Date endQuery = new Date();;                                 if (startDate == null){                     startQuery = new Date();                     Calendar cal = Calendar.getInstance();                     cal.setTime(endQuery);                     cal.add(Calendar.MONTH, -1);                     startQuery = cal.getTime();                 } else                     startQuery = startDate;                                 if (endDate != null)                     endQuery = endDate;                                 StringBuilder query = new StringBuilder();                                 query.append("SELECT distinct date_format(aaf.date, '%d-%m-%Y'), aaf.userId ");                 query.append("FROM org.alfresco.repo.audit.hibernate.AuditFactImpl aaf, org.alfresco.repo.audit.hibernate.AuditSourceImpl aas ");                 query.append("WHERE aaf.auditSource = aas ")                     .append("AND aas.method = 'authenticate' ")                     .append("AND aas.service = 'AuthenticationService' ")                     .append("AND aaf.date BETWEEN :start AND :end ")                     .append("ORDER BY aaf.date DESC");                                 Query queryResult = session.createQuery(query.toString());                 queryResult.setParameter("start", startQuery);                 queryResult.setParameter("end", endQuery);                                 return queryResult.list();             }         };         List<Object[]> result = (List<Object[]>) (getHibernateTemplate().execute(callback));         return result;     }

What does this query do, it retrieves the Unique Logins through the AuthenticationService, which should be enabled in the AuditConfig-Custom.xml.

So you've got your results in an List<Object[]>, so how can we loop through these results?

The Object[] is an array containing the results from the specified columns. So Object[0] = aaf.date and Object[1] is aaf.userId.

Map<String, Object> map = new HashMap<String, Object>(); for (Object[] objects : result) {     String date = Object[0];     String userId = Object[1];     //Do whatever you like with the results     //Eventually put the results in a Map so they can be used in the Webscript/FTL     map.put("user", objects[1]);     map.put("date", objects[0]); }

Full code of this Java-Backed Webscript:

public class RetreiveUniqueLogin extends DeclarativeWebScript {         private DBQuery DBQuery;         private SimpleDateFormat sf = new SimpleDateFormat("dd MM yyyy");     protected Map<String, Object> executeImpl(WebScriptRequest req, WebScriptStatus status) {                 String start = req.getParameter("startDate");         String end = req.getParameter("endDate");                 Date startDate = null;         Date endDate = null;         try {             if (start != null && start.length() > 0)                 startDate = sf.parse(start);             if (end != null && end.length() > 0)                 endDate = sf.parse(end);         } catch (ParseException e) {             // TODO Auto-generated catch block             e.printStackTrace();         }                 List<Object[]> results = DBQuery.getResultSet(startDate, endDate);         Map<String, Object> map = new HashMap<String, Object>();                 // loop through the results and send smart objects instead of a Object[]         for (Object[] objects : results) {             map.put("user", objects[1]);             map.put("date", objects[0]);         }                 Map<String, Object> model = new HashMap<String, Object>(7, 1.0f);         model.put("auditResults", map);         return model;     }

  public DBQuery getDBQuery() {         return DBQuery;     }     public void setDBQuery(DBQuery DBQuery) {         this.DBQuery = DBQuery;     }

And we need a Freemarker Template to present the results.

<table id="auditPreviewTable" border="0" class="tablesorter">     <thead>     <tr>         <th>Date</th>         <th>User</th>     </tr>     </thead>     <#if auditResults??>         <#list auditResults as result>             <tr>                 <td>${result["date"]}</td>                 <td>${result["user"]}</td>             </tr>         </#list>     </#if>     </tbody> </table>

And of course you need to register the Java-Backed Webscript in a context file.

!!This code is written for an Alfresco version 2.2.x, so there is a big chance some classes are changed, the Webscript class is definitely changed, but some Hibernate imports could also differ!!