NAR updates
Security changes
FIX Security issue!
Previous rule WEDIA Packaged - Self user in objectdata/update did not prevent a user from changing its role. Find below new rule implementation
objectdata/update
WEDIA Packaged - Self user
Rule details
Description:
A surfer can update its own user--> A surfer can update its own user as long as he doesn't change its role or role type
Old Expression:
@pkgIsSurferSelfUser()
New Expression:
@pkgIsSurferSelfUser() AND object.role = surfer.roleid AND object.pkgroletemplate = surfer.pkgroletemplate
New objectactions domain action created: i18nFieldsTranslate
objectactions domain
i18nFieldsTranslate(ADDED)
Action description
Description:
Enabled: true
Action parameters:
objectname:
wsnoheto.securite.parameter.LowerStringParametersurfer:
wsnoheto.securite.parameter.SurferParameter
Rules:
WEDIA Packaged - Default rule
Rule details
Description: Relies on permissions granted to role
Enabled: true
Blocking: false
Expression:
@pkgV1ObjectActions('i18nFieldsTranslate')WEDIA Packaged - Developper
Rule details
Description: Developers can do everything
Enabled: true
Blocking: false
Expression:
@pkgIsSurferDeveloper()
applications domain is now activated by default
applications
Enabled:
false--> true
Structures changes
All structures changes are directly related to the role management feature.
Unless you are planning to open this feature on your project, such changes are not required
Instances changes
Most instances changes are directly related to the role management feature.
Unless you are planning to open this feature on your project, such changes are not required
In a nutshell
assetrighttypeinstances are now delivered with status 6 - so they are immediately visible by all usersobjectfamilyof ID 9999 is created → this will force families created by project to have a greater ID and leaves room for future product entries without conflictspkgroletemplateif IDs 1, 2 and 3 have been moved to IDs 997, 998 and 999. Again, this leaves room for future product entries.Some
rubriqueinstances have been deactivated (to keep only dam related menus)rubriqueof ID 10047 has its URL property change to access the wedia-config interfacerolehave been updated according to rubrique deactivations
Plugins changes
PACKAGED_BOV3_DashboardWidgets
plugin.xml
Parameters:
UPDATED default_roletemplate_widgets:
default value:
Old:
{ "3": { "bloc": [ { "code":"listAssetsCall2Action", "title":"block_assets_list_c2a", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/assets_c2a.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":"" }, { "code":"latestAssets", "title":"block_latest_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/latest_assets.jspz", "img":"", "open":"true", "nbr":"5", "col":"" }, { "code":"expiringAssets", "title":"block_expiring_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/expiring_assets.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":0 }, { "code":"PACKAGED_BOV3_DashboardWidgets_pendingassets", "title":"PACKAGED_BOV3_DashboardWidgets_pendingassets_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"pendingassets", "col":1 }, { "code":"PACKAGED_BOV3_DashboardWidgets_userrequests", "title":"PACKAGED_BOV3_DashboardWidgets_userrequests_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"userrequests", "col":1 },{ "code":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords", "title":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":true, "nbr":"5", "params":"candidates_keywords", "col":1 } ] }, "2": { "bloc": [ { "code":"listAssetsCall2Action", "title":"block_assets_list_c2a", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/assets_c2a.jspz", "open":"true", "img":"", "nbr":"5", "params":"","col":"" }, { "code":"PACKAGED_BOV3_DashboardWidgets_rejectedassets", "title":"PACKAGED_BOV3_DashboardWidgets_rejectedassets_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"rejectedassets", "col":1 }, { "code":"latestAssets", "title":"block_latest_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/latest_assets.jspz", "img":"", "open":"true", "nbr":"5", "col":"" }, { "code":"expiringAssets", "title":"block_expiring_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/expiring_assets.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":0 }, { "code":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords", "title":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":true, "nbr":"5", "params":"candidates_keywords", "col":1 } ] }, "1": { "bloc": [] } }New:
{ "997": { "bloc": [ { "code":"listAssetsCall2Action", "title":"block_assets_list_c2a", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/assets_c2a.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":"" }, { "code":"latestAssets", "title":"block_latest_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/latest_assets.jspz", "img":"", "open":"true", "nbr":"5", "col":"" }, { "code":"expiringAssets", "title":"block_expiring_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/expiring_assets.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":0 }, { "code":"PACKAGED_BOV3_DashboardWidgets_pendingassets", "title":"PACKAGED_BOV3_DashboardWidgets_pendingassets_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"pendingassets", "col":1 }, { "code":"PACKAGED_BOV3_DashboardWidgets_userrequests", "title":"PACKAGED_BOV3_DashboardWidgets_userrequests_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"userrequests", "col":1 },{ "code":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords", "title":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":true, "nbr":"5", "params":"candidates_keywords", "col":1 } ] }, "998": { "bloc": [ { "code":"listAssetsCall2Action", "title":"block_assets_list_c2a", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/assets_c2a.jspz", "open":"true", "img":"", "nbr":"5", "params":"","col":"" }, { "code":"PACKAGED_BOV3_DashboardWidgets_rejectedassets", "title":"PACKAGED_BOV3_DashboardWidgets_rejectedassets_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":"true", "nbr":"5", "params":"rejectedassets", "col":1 }, { "code":"latestAssets", "title":"block_latest_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/latest_assets.jspz", "img":"", "open":"true", "nbr":"5", "col":"" }, { "code":"expiringAssets", "title":"block_expiring_assets_label", "path":"/_plugins/PACKAGED_DAM_DashboardWidgets/page/bov3/dataindex/content/widgets/expiring_assets.jspz", "open":"true", "img":"", "nbr":"5", "params":"", "col":0 }, { "code":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords", "title":"PACKAGED_BOV3_DashboardWidgets_candidates_keywords_title", "path":"/_plugins/PACKAGED_BOV3_DashboardWidgets/page/bov3/dataindex/content/widgets/configured_items.jspz", "open":true, "nbr":"5", "params":"candidates_keywords", "col":1 } ] }, "999": { "bloc": [] } }
PACKAGED_PortalAssetPickerSandbox (ADDED)
plugin.xml
Parameters:
pluginName:
type:
stringmandatory:
truedescription:
default value:
PACKAGED_Portal
libName:
type:
stringmandatory:
truedescription:
default value:
wedia-content-picker.js
defaultConfig:
type:
jsonmandatory:
truedescription:
default value:
{ "assetNatures": "IMAGE", "variations": "circle_png", "min": 1, "max": 1, "fulltext": "", "showPreview": false, "showFilters": false, "ordered": false, "showSort": false, "showCursors": true, "showCropper": true, "showFocus": false, "expectedWidth": 500, "expectedHeight": 300, "configPaths": [ { "value": "", "text": "", "selected": true }, { "value": "picker-hotels", "text": "picker-hotels", "selected": false } ] }
PACKAGED_Security
plugin.xml
Services:
ADDED
com.wedia.packaged.security.extensions.PackagedSecurityIntegrityCheck(com.noheto.extensions.interfaces.services.IObjectTriggerBusinessService)
Parameters:
UPDATED role_template_default_permissions:
default value:
Old:
{ "v1": { "objectdata":{ "#damobject": { "editpicture": { "enabled": false, "permissions": [] }, "slicevideo": { "enabled": false, "permissions": [] }, "broadcastvideo": { "enabled": false, "permissions": [] }, "definevideoposter": { "enabled": false, "permissions": [] }, "editvideochapters": { "enabled": false, "permissions": [] }, "editvideosubtitles": { "enabled": false, "permissions": [] }, "embed": { "enabled": false, "permissions": [] }, "managevideocalltoactions": { "enabled": false, "permissions": [] }, "managevideorolls": { "enabled": false, "permissions": [] } } } } }New:
{ "v1": { "objectdata": { "#damobject": { "broadcastvideo": { "enabled": false, "permissions": [] }, "definevideoposter": { "enabled": false, "permissions": [] }, "editpicture": { "enabled": false, "permissions": [] }, "editvideochapters": { "enabled": false, "permissions": [] }, "editvideosubtitles": { "enabled": false, "permissions": [] }, "embed": { "enabled": false, "permissions": [] }, "managevideocalltoactions": { "enabled": false, "permissions": [] }, "managevideorolls": { "enabled": false, "permissions": [] }, "sharesocialnetworks": { "enabled": false, "permissions": [] }, "slicevideo": { "enabled": false, "permissions": [] } }, "resolution": { "view": { "enabled": false, "permissions": ["$anystatus/$anyowner"] } }, "user": { "insert": { "enabled": false, "permissions": [] }, "update": { "enabled": false, "permissions": [] }, "delete": { "enabled": false, "permissions": [] }, "changestatus": { "enabled": false, "permissions": [] }, "view": { "enabled": false, "permissions": ["$online/$anyowner"] } }, "userregistration": { "insert": { "enabled": false, "permissions": [] }, "update": { "enabled": false, "permissions": [] }, "delete": { "enabled": false, "permissions": [] }, "changestatus": { "enabled": false, "permissions": [] }, "view": { "enabled": false, "permissions": [] } }, "vueapphomewidget": { "view": { "enabled": true, "permissions": ["$online/$anyowner"] } } }, "applications": { "isavailable": { "enabled": false, "permissions": ["portal"] } } } }
UPDATED permissions_inferring:
default value:
Old:
[ { "class": "com.wedia.packaged.security.inferring.impl.MassimportInferenceProvider", "init": { "massimportjob": [ "v1/objectdata/changestatus/start/2/$anyowner", "v1/objectdata/delete/2/$anyowner", "v1/objectdata/insert/$newcreation", "v1/objectdata/update/2/$anyowner", "v1/objectdata/view/2/$anyowner" ], "massimportitem": [ "v1/objectdata/changestatus/$anyaction/2/$anyowner", "v1/objectdata/changestatus/$anyaction/9/$anyowner", "v1/objectdata/changestatus/$anyaction/14/$anyowner", "v1/objectdata/changestatus/$anyaction/8/$anyowner", "v1/objectdata/changestatus/$anyaction/13/$anyowner", "v1/objectdata/delete/2/$anyowner", "v1/objectdata/delete/9/$anyowner", "v1/objectdata/delete/14/$anyowner", "v1/objectdata/delete/8/$anyowner", "v1/objectdata/delete/13/$anyowner", "v1/objectdata/insert/$newcreation", "v1/objectdata/update/2/$anyowner", "v1/objectdata/update/9/$anyowner", "v1/objectdata/update/14/$anyowner", "v1/objectdata/update/8/$anyowner", "v1/objectdata/update/13/$anyowner", "v1/objectdata/view/$anystatus/$anyowner", "v1/objectfile/sendfile/$anystatus/$anyowner/$anyconfidentiality" ] } } ]New:
[ { "class": "com.wedia.packaged.security.inferring.impl.MassimportInferenceProvider", "init": { "massimportjob": [ "v1/objectdata/changestatus/start/2/$anyowner", "v1/objectdata/delete/2/$anyowner", "v1/objectdata/insert/$newcreation", "v1/objectdata/update/2/$anyowner", "v1/objectdata/view/2/$anyowner" ], "massimportitem": [ "v1/objectdata/changestatus/$anyaction/2/$anyowner", "v1/objectdata/changestatus/$anyaction/9/$anyowner", "v1/objectdata/changestatus/$anyaction/14/$anyowner", "v1/objectdata/changestatus/$anyaction/8/$anyowner", "v1/objectdata/changestatus/$anyaction/13/$anyowner", "v1/objectdata/delete/2/$anyowner", "v1/objectdata/delete/9/$anyowner", "v1/objectdata/delete/14/$anyowner", "v1/objectdata/delete/8/$anyowner", "v1/objectdata/delete/13/$anyowner", "v1/objectdata/insert/$newcreation", "v1/objectdata/update/2/$anyowner", "v1/objectdata/update/9/$anyowner", "v1/objectdata/update/14/$anyowner", "v1/objectdata/update/8/$anyowner", "v1/objectdata/update/13/$anyowner", "v1/objectdata/view/$anystatus/$anyowner", "v1/objectfile/sendfile/$anystatus/$anyowner/$anyconfidentiality" ], "wkfmassimportitem": [ "v1/objectdata/view/$anystatus/$anyowner" ], "wkfmassimportjob": [ "v1/objectdata/view/$anystatus/$anyowner" ] } } ]
security.xml
{#unless (eq @key 'added')}}
UPDATED @key
Old expression
/* Object has appropriate tag */
(
/* Tous */
CONFIGHASTAG(objectname, 'pkg/security/secugroup/all')
OR
/* Qui ont l'action */
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/', LOWER(arguments.action)))
OR
(
/* Les droits de create,damimport,massimport sont liés à l'insert */
NBCOMMONELEMENTS(LOWER(arguments.action), 'create,damimport,massimport') > 0
AND
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/insert'))
)
OR
(
/* Le droit de multiupdate est lié à l'update */
LOWER(arguments.action) = 'multiupdate'
AND
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/update'))
)
)
AND
(
/* insert/create action */
(
NBCOMMONELEMENTS(LOWER(arguments.action), 'create,damimport,massimport,insert') > 0
AND
(
/* User has rights to create this kind of object if he has $anycreation or $newcreation (but not $copycreation) */
NBCOMMONELEMENTS(surfer.pkgsecurity_v1_objectdata, CONCAT('insert', ':', objectname, ':', '$anycreation'), ',') > 0
OR
NBCOMMONELEMENTS(surfer.pkgsecurity_v1_objectdata, CONCAT('insert', ':', objectname, ':', '$newcreation'), ',') > 0
)
)
OR
(
/* multiupdate/datavaluespicker action */
NBCOMMONELEMENTS(LOWER(arguments.action), 'datavaluespicker,multiupdate,update') > 0
AND
/* User has rights to datavaluespicker/multiupdate if he has right to update, but regardless of modifiers */
NBCOMMONELEMENTS(
REPLACE(
surfer.pkgsecurity_v1_objectdata,
CONCAT('update:', objectname, ':'),
CONCAT('update:', objectname, ',::')
) /* permet de passer de update:objectname:xx*/,
CONCAT('update:', objectname)
) > 0
)
OR
(
/* other actions */
NBCOMMONELEMENTS(LOWER(arguments.action), LOWER('broadcastVideo,defineVideoPoster,delete,editPicture,editVideoChapters,editVideoSubtitles,embed,manageVideoCallToActions,manageVideoRolls,order,sliceVideo,shareSocialNetworks,view')) > 0
AND
/* User has rights to other actions if he has right to other actions, but regardless of modifiers */
NBCOMMONELEMENTS(
REPLACE(
surfer.pkgsecurity_v1_objectdata,
CONCAT(LOWER(arguments.action), ':', objectname, ':'),
CONCAT(LOWER(arguments.action), ':', objectname, ',::')
),
CONCAT(LOWER(arguments.action), ':', objectname)
) > 0
)
)
New expression
/* Object has appropriate tag */
(
/* Tous */
CONFIGHASTAG(objectname, 'pkg/security/secugroup/all')
OR
/* Qui ont l'action */
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/', LOWER(arguments.action)))
OR
(
/* Les droits de create,damimport,massimport sont liés à l'insert */
NBCOMMONELEMENTS(LOWER(arguments.action), 'create,damimport,massimport') > 0
AND
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/insert'))
)
OR
(
/* Le droit de multiupdate est lié à l'update */
LOWER(arguments.action) = 'multiupdate'
AND
CONFIGHASTAG(objectname, CONCAT('pkg/security/secugroup/update'))
)
)
AND
(
/* insert/create action */
(
NBCOMMONELEMENTS(LOWER(arguments.action), 'create,damimport,massimport,insert') > 0
AND
(
/* User has rights to create this kind of object if he has $anycreation or $newcreation (but not $copycreation) */
NBCOMMONELEMENTS(surfer.pkgsecurity_v1_objectdata, CONCAT('insert', ':', objectname, ':', '$anycreation'), ',') > 0
OR
NBCOMMONELEMENTS(surfer.pkgsecurity_v1_objectdata, CONCAT('insert', ':', objectname, ':', '$newcreation'), ',') > 0
)
)
OR
(
/* multiupdate/datavaluespicker action */
NBCOMMONELEMENTS(LOWER(arguments.action), 'datavaluespicker,multiupdate,update') > 0
AND
/* User has rights to datavaluespicker/multiupdate if he has right to update, but regardless of modifiers */
NBCOMMONELEMENTS(
REPLACE(
surfer.pkgsecurity_v1_objectdata,
CONCAT('update:', objectname, ':'),
CONCAT('update:', objectname, ',::')
) /* permet de passer de update:objectname:xx*/,
CONCAT('update:', objectname)
) > 0
)
OR
(
/* other actions */
NBCOMMONELEMENTS(LOWER(arguments.action), LOWER('broadcastVideo,defineVideoPoster,delete,editPicture,editVideoChapters,editVideoSubtitles,embed,i18nFieldsTranslate,manageVideoCallToActions,manageVideoRolls,order,sliceVideo,shareSocialNetworks,view')) > 0
AND
/* User has rights to other actions if he has right to other actions, but regardless of modifiers */
NBCOMMONELEMENTS(
REPLACE(
surfer.pkgsecurity_v1_objectdata,
CONCAT(LOWER(arguments.action), ':', objectname, ':'),
CONCAT(LOWER(arguments.action), ':', objectname, ',::')
),
CONCAT(LOWER(arguments.action), ':', objectname)
) > 0
)
)
WXM_ANALYTICS_V2
plugin.xml
Parameters:
UPDATED available_menus:
WXM_Multiupload_Config
plugin.xml
Parameters:
UPDATED jsonConfigs:
description: ~~format: {"s3Configs":[{"region":"eu-west-1","bucketName":"monbicket"}], "ftpConfigs":[{"url":"ftp://pipo"}]}~~ -->
format: {"s3Configs":[{"region":"eu-west-1","bucketName":"monbicket"}], "ftpConfigs":[{"url":"<ftp://pipo"},> {"url":"<ftp://pipo",> "ftpsUse":true, "ftpsImplicit":true, "ftpsProtocol":"TLS|SSL","ftpsTrustmgr":"all|valid|none"}]}
Portal upgrades
Disabling number of retrieved boards
Before 2022.5.0, it was not possible to retrieve more than 1000 shared boards and 5000 public boards. Even more, the limit had been set to 1000 shared boards and 1000 public boards.
It is now possible to bypass those limitations by setting some special values to /src/common/wedia-vue-helpers/initWediaVue/legacy.js
// 'carts.maxPublicCarts': 1000, // 'carts.maxSharedCarts': 1000, 'carts.maxPublicCarts': -1, // no limit 'carts.maxSharedCarts': -1, // no limit
Future version of portal may change this default configuration, but as of 2022.5.0, it is an opt-in action.
Configuration for upload feature
The upload feature can now be handled by the security. To use this mechanism, the $feature.action must be configured with an object instead of a boolean.
Model of the configuration object :
// With a named shema
{
"schemaSecurity": {
name: "damImportTarget",
security: "objectactions/create"
}
}
// Without named schema
{
"schemaSecurity": {
name: "dam/asset",
security: "objectactions/create"
}
}
We’ve added the possibility to create namedSchemas for reusability purpose.
security value is the rule you want to test to enable (or disable) the feature.
This configuration enable the possibility to control more precisely who can access to the feature. A user without access to the upload feature will not see the link to the upload page in the menu, nor in the header.
This method will now be recommended instead of the usage of onlyForUserGroups in the configuration of the upload link in the menu ($menu.actionsAvailabled).
Configuration to use new Profile form
You can now use a new form component in profile page, this component use faces and consistent form validation. This form is driven by the user object structure AND the portal configuration file. That means that all fields set as editable in structure will be retrieve by the form but this list will be filtered by what you specified in $profile.editablefields. If no editable fields are provided, all the field defined in structure will be displayed.
All other configurations are still used. If you want to keep the old form you’ll have nothing to do, to use the new form you’ll have to add $profile.useLegacy and set it to true.
If you use the new form you can configure your fields like any other fields in the portal application (by setting and customize $edit.profil.fields either by field names or by field types.
New block layout replaces list layout
A new layout has been created for one of our clients and has now replaced the list layout in the search results page and on the board’s detail page (when displaying assets of a board).
The layout displays 4 assets each with metadata underneath but it can display up to 6 assets on very large screens.
A default metadata configuration has been created but this can be changed under $.common.namedDisplays.assetBlock.
If you would like to add the list layout in the search results page, you can configure it in $.dam.explore.layouts.defaultCursorConfig.defaultResourceConfig.
If you would like to add the list layout in the board’s detail page, you can configure it in $.board.explore.layout.available.