Uploaded image for project: 'Red Hat Process Automation Manager'
  1. Red Hat Process Automation Manager
  2. RHPAM-275

A user can display tasks for which he is not PotOwner or BussinesAdm in BPM Suite 6.4

XMLWordPrintable

    • ER5
    • Hide

      1) create user bpmUser1 (roles user,group1)
      2) create user bpmUser2 (roles user,group2)
      3) create a business process with 2 human tasks. The first human task assigned to group1, the second human task assigend to group2.
      4) Start the process
      5) Login to Business Central as user bpmUser1. You will see a task.
      6)Write down the taskId.
      7) Login to Business Central as user bmpUser2. You will see no tasks yet.
      8) Access the taskform of the task directly using the following url and replace the taskId with the taskId you have written down:
      http://localhost:8080/business-central/kie-wb.jsp?perspective=FormDisplayPerspective&standalone=true&opener=localhost:8080&taskId=6

      You should see the same as the attachment (content.png).

      Show
      1) create user bpmUser1 (roles user,group1) 2) create user bpmUser2 (roles user,group2) 3) create a business process with 2 human tasks. The first human task assigned to group1, the second human task assigend to group2. 4) Start the process 5) Login to Business Central as user bpmUser1. You will see a task. 6)Write down the taskId. 7) Login to Business Central as user bmpUser2. You will see no tasks yet. 8) Access the taskform of the task directly using the following url and replace the taskId with the taskId you have written down: http://localhost:8080/business-central/kie-wb.jsp?perspective=FormDisplayPerspective&standalone=true&opener=localhost:8080&taskId=6 You should see the same as the attachment (content.png).

      It has been identified a critical security issue in business-central. It is possible to access data from a specific HT by using a direct URL and an user who is not a potential owner or business administrator:

        1. content.png
          12 kB
          Amana Juricic
        2. taskFormUrl.png
          51 kB
          Bojan Sremac

              rh-ee-pefernan Pere Fernandez Perez
              rhn-support-ajuricic Amana Juricic
              Bojan Sremac Bojan Sremac (Inactive)
              Bojan Sremac Bojan Sremac (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: