Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Major
    • Resolution: Cannot Reproduce
    • Affects Version/s: None
    • Fix Version/s: 16.11.01
    • Component/s: accounting
    • Labels:
      None
    • Sprint:
      Bug Crush Event - 21/2/2015

      Description

      Found URL parameter [glAccountTypeId] passed to secure (https) request-map with uri [createGlAccountTypeD
      fault] with an event that calls service [createGlAccountTypeDefault]; this is not allowed for security reasons! The data should be encrypted by making it part of the request body (a form field) instead of threquest URL.

        Activity

        Hide
        pfm.smits Pierre Smits added a comment -

        Isn't this related to the accounting component?

        Show
        pfm.smits Pierre Smits added a comment - Isn't this related to the accounting component?
        Hide
        jacques.le.roux Jacques Le Roux added a comment -

        Thanks Pierre, I selected the wrong line I guess

        Show
        jacques.le.roux Jacques Le Roux added a comment - Thanks Pierre, I selected the wrong line I guess
        Hide
        pfm.smits Pierre Smits added a comment -

        So, from a form in a screen accessed via a secure request-map you pass through a parameter to another secure request-map that cals a service to get some result back?

        I have the same issue in a somewhat similar aspect using getDependentDropdownValues to get some results back in a json format.

        How to circumvent this?

        Show
        pfm.smits Pierre Smits added a comment - So, from a form in a screen accessed via a secure request-map you pass through a parameter to another secure request-map that cals a service to get some result back? I have the same issue in a somewhat similar aspect using getDependentDropdownValues to get some results back in a json format. How to circumvent this?
        Hide
        jacques.le.roux Jacques Le Roux added a comment -

        I can't reproduce this, so closing

        2016-10-23 11:56:50,292 |http-nio-8443-exec-4 |ControlServlet                |T| [[[createGlAccountTypeDefault(Domain:https://localhost)] Request Begun, encoding=[UTF-8]- total:0.0,since last(Begin):0.0]]
        2016-10-23 11:56:50,309 |http-nio-8443-exec-4 |ConfigXMLReader               |I| controller loaded: 0.006s, 9 requests, 9 views in file:/C:/projectASF-Mars/ofbiz/specialpurpose/birt/webapp/accounting/WEB-INF/
        controller.xml
        2016-10-23 11:56:50,589 |http-nio-8443-exec-4 |ConfigXMLReader               |I| controller loaded: 0.268s, 505 requests, 238 views in file:/C:/projectASF-Mars/ofbiz/applications/accounting/webapp/accounting/
        WEB-INF/controller.xml
        2016-10-23 11:56:50,635 |http-nio-8443-exec-4 |ConfigXMLReader               |I| controller loaded: 0.037s, 45 requests, 22 views in file:/C:/projectASF-Mars/ofbiz/framework/common/webcommon/WEB-INF/common-co
        ntroller.xml
        2016-10-23 11:56:50,643 |http-nio-8443-exec-4 |ConfigXMLReader               |I| controller loaded: 0.0s, 0 requests, 0 views in file:/C:/projectASF-Mars/ofbiz/framework/common/webcommon/WEB-INF/handlers-cont
        roller.xml
        2016-10-23 11:56:50,653 |http-nio-8443-exec-4 |ConfigXMLReader               |I| controller loaded: 0.002s, 4 requests, 0 views in file:/C:/projectASF-Mars/ofbiz/applications/commonext/webapp/WEB-INF/controll
        er.xml
        2016-10-23 11:56:50,698 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/acctgPrefPermissionCheck] finished in [39] milliseconds
        2016-10-23 11:56:50,703 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/createGlAccountTypeDefault] finished in [44] milliseconds
        2016-10-23 11:56:50,703 |http-nio-8443-exec-4 |RequestHandler                |I| Ran Event [service:#createGlAccountTypeDefault] from [request], result is [success]
        2016-10-23 11:56:50,705 |http-nio-8443-exec-4 |RequestHandler                |I| Rendering View [GlAccountTypeDefaults].  Hidden sessionId by default.
        2016-10-23 11:56:50,708 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/getUserPreferenceGroup] finished in [1] milliseconds
        2016-10-23 11:56:50,758 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/getVisualThemeResources] finished in [47] milliseconds
        2016-10-23 11:56:50,767 |http-nio-8443-exec-4 |ScreenFactory                 |I| Got 27 screens in 0.006s from: file:/C:/projectASF-Mars/ofbiz/applications/accounting/widget/GlSetupScreens.xml
        2016-10-23 11:56:50,775 |http-nio-8443-exec-4 |ScreenFactory                 |I| Got 11 screens in 0.006s from: file:/C:/projectASF-Mars/ofbiz/applications/accounting/widget/CommonScreens.xml
        2016-10-23 11:56:50,781 |http-nio-8443-exec-4 |ScreenFactory                 |I| Got 1 screens in 0.005s from: file:/C:/projectASF-Mars/ofbiz/applications/commonext/widget/CommonScreens.xml
        2016-10-23 11:56:50,829 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/getLastSystemInfoNote] finished in [26] milliseconds
        2016-10-23 11:56:50,840 |http-nio-8443-exec-4 |ScreenFactory                 |I| Got 26 screens in 0.007s from: file:/C:/projectASF-Mars/ofbiz/framework/common/widget/CommonScreens.xml
        2016-10-23 11:56:50,843 |http-nio-8443-exec-4 |ServiceDispatcher             |T| Sync service [accounting/getVisualThemeResources] finished in [1] milliseconds
        2016-10-23 11:56:50,978 |http-nio-8443-exec-4 |ServerHitBin                  |I| Visit delegatorName=default, ServerHitBin delegatorName=default
        2016-10-23 11:56:50,979 |http-nio-8443-exec-4 |ControlServlet                |T| [[[createGlAccountTypeDefault(Domain:https://localhost)] Request Done- total:0.687,since last([createGlAccountT...):0.687]]
        
        Show
        jacques.le.roux Jacques Le Roux added a comment - I can't reproduce this, so closing 2016-10-23 11:56:50,292 |http-nio-8443-exec-4 |ControlServlet |T| [[[createGlAccountTypeDefault(Domain:https: //localhost)] Request Begun, encoding=[UTF-8]- total:0.0,since last(Begin):0.0]] 2016-10-23 11:56:50,309 |http-nio-8443-exec-4 |ConfigXMLReader |I| controller loaded: 0.006s, 9 requests, 9 views in file:/C:/projectASF-Mars/ofbiz/specialpurpose/birt/webapp/accounting/WEB-INF/ controller.xml 2016-10-23 11:56:50,589 |http-nio-8443-exec-4 |ConfigXMLReader |I| controller loaded: 0.268s, 505 requests, 238 views in file:/C:/projectASF-Mars/ofbiz/applications/accounting/webapp/accounting/ WEB-INF/controller.xml 2016-10-23 11:56:50,635 |http-nio-8443-exec-4 |ConfigXMLReader |I| controller loaded: 0.037s, 45 requests, 22 views in file:/C:/projectASF-Mars/ofbiz/framework/common/webcommon/WEB-INF/common-co ntroller.xml 2016-10-23 11:56:50,643 |http-nio-8443-exec-4 |ConfigXMLReader |I| controller loaded: 0.0s, 0 requests, 0 views in file:/C:/projectASF-Mars/ofbiz/framework/common/webcommon/WEB-INF/handlers-cont roller.xml 2016-10-23 11:56:50,653 |http-nio-8443-exec-4 |ConfigXMLReader |I| controller loaded: 0.002s, 4 requests, 0 views in file:/C:/projectASF-Mars/ofbiz/applications/commonext/webapp/WEB-INF/controll er.xml 2016-10-23 11:56:50,698 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/acctgPrefPermissionCheck] finished in [39] milliseconds 2016-10-23 11:56:50,703 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/createGlAccountTypeDefault] finished in [44] milliseconds 2016-10-23 11:56:50,703 |http-nio-8443-exec-4 |RequestHandler |I| Ran Event [service:#createGlAccountTypeDefault] from [request], result is [success] 2016-10-23 11:56:50,705 |http-nio-8443-exec-4 |RequestHandler |I| Rendering View [GlAccountTypeDefaults]. Hidden sessionId by default . 2016-10-23 11:56:50,708 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/getUserPreferenceGroup] finished in [1] milliseconds 2016-10-23 11:56:50,758 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/getVisualThemeResources] finished in [47] milliseconds 2016-10-23 11:56:50,767 |http-nio-8443-exec-4 |ScreenFactory |I| Got 27 screens in 0.006s from: file:/C:/projectASF-Mars/ofbiz/applications/accounting/widget/GlSetupScreens.xml 2016-10-23 11:56:50,775 |http-nio-8443-exec-4 |ScreenFactory |I| Got 11 screens in 0.006s from: file:/C:/projectASF-Mars/ofbiz/applications/accounting/widget/CommonScreens.xml 2016-10-23 11:56:50,781 |http-nio-8443-exec-4 |ScreenFactory |I| Got 1 screens in 0.005s from: file:/C:/projectASF-Mars/ofbiz/applications/commonext/widget/CommonScreens.xml 2016-10-23 11:56:50,829 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/getLastSystemInfoNote] finished in [26] milliseconds 2016-10-23 11:56:50,840 |http-nio-8443-exec-4 |ScreenFactory |I| Got 26 screens in 0.007s from: file:/C:/projectASF-Mars/ofbiz/framework/common/widget/CommonScreens.xml 2016-10-23 11:56:50,843 |http-nio-8443-exec-4 |ServiceDispatcher |T| Sync service [accounting/getVisualThemeResources] finished in [1] milliseconds 2016-10-23 11:56:50,978 |http-nio-8443-exec-4 |ServerHitBin |I| Visit delegatorName= default , ServerHitBin delegatorName= default 2016-10-23 11:56:50,979 |http-nio-8443-exec-4 |ControlServlet |T| [[[createGlAccountTypeDefault(Domain:https: //localhost)] Request Done- total:0.687,since last([createGlAccountT...):0.687]]

          People

          • Assignee:
            jacques.le.roux Jacques Le Roux
            Reporter:
            jacques.le.roux Jacques Le Roux
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development

                Agile