NAR updates
Security changes
FIX Security issue!
Previous rule WEDIA Packaged - Self user in objectdata/update did not prevent a user from changing its role. Find below new rule implementation
objectdata/update
WEDIA Packaged - Self user
Rule details
Description:
A surfer can update its own user--> A surfer can update its own user as long as he doesn't change its role or role type
Old Expression:
@pkgIsSurferSelfUser()
New Expression:
@pkgIsSurferSelfUser() AND object.role = surfer.roleid AND object.pkgroletemplate = surfer.pkgroletemplate
New objectactions domain action created: i18nFieldsTranslate
objectactions domain
i18nFieldsTranslate(ADDED)
Action description
Description:
Enabled: true
Action parameters:
objectname:
wsnoheto.securite.parameter.LowerStringParametersurfer:
wsnoheto.securite.parameter.SurferParameter
Rules:
WEDIA Packaged - Default rule
Rule details
Description: Relies on permissions granted to role
Enabled: true
Blocking: false
Expression:
@pkgV1ObjectActions('i18nFieldsTranslate')WEDIA Packaged - Developper
Rule details
Description: Developers can do everything
Enabled: true
Blocking: false
Expression:
@pkgIsSurferDeveloper()
applications domain is now activated by default
applications
Enabled:
false--> true
Portal configuration for upload feature
The upload feature can now be handled by the security. To use this mechanism, the $feature.action must be configured with an object instead of a boolean.
Model of the configuration object :
// With a named shema
{
"schemaSecurity": {
name: "damImportTarget",
security: "objectactions/create"
}
}
// Without named schema
{
"schemaSecurity": {
name: "dam/asset",
security: "objectactions/create"
}
}
We’ve added the possibility to create namedSchemas for reusability purpose.
security value is the rule you want to test to enable (or disable) the feature.
This configuration enable the possibility to control more precisely who can access to the feature. A user without access to the upload feature will not see the link to the upload page in the menu, nor in the header.
This method will now be recommended instead of the usage of onlyForUserGroups in the configuration of the upload link in the menu ($menu.actionsAvailabled).
Portal configuration to use new Profile form
You can now use a new form component in profile page, this component use faces and consistent form validation. This form is driven by the user object structure AND the portal configuration file. That means that all fields set as editable in structure will be retrieve by the form but this list will be filtered by what you specified in $profile.editablefields. If no editable fields are provided, all the field defined in structure will be displayed.
All other configurations are still used. If you want to keep the old form you’ll have nothing to do, to use the new form you’ll have to add $profile.useLegacy and set it to true.
If you use the new form you can configure your fields like any other fields in the portal application (by setting and customize $edit.profil.fields either by field names or by field types.