[Geoserver-devel] [JIRA] (GEOS-7429) Workspace Isolation Bug

Brian Farrell created an issue

GeoServer / BugGEOS-7429

Workspace Isolation Bug

Issue Type:

BugBug

Affects Versions:

2.8.2

Assignee:

Unassigned

Components:

Security

Created:

16/Feb/16 3:58 PM

Environment:

Version
2.8.2
Git Revision
f1366aa5e0c9d477b9c6a05fd31d59e0e81985f9
Build Date
23-Jan-2016 02:21
GeoTools Version
14.2 (rev 73d5c95ed430b6c891eb2f0dfebb742ba01780fe)
GeoWebCache Version
1.8.1 (rev f22447f59ca37f72bfe6bc746d834b0e73e7c3fc/f22447f59ca37f72bfe6bc746d834b0e73e7c3fc)

No plugins are installed.

Labels:

Security geoserver

Priority:

MediumMedium

Reporter:

Brian Farrell

I’m trying to set up geoserver for a web mapping class. This means that each students’ work needs to be kept separate from each others’ (for privacy, cheating prevention, and trolling prevention). My current plan is to give each team access to only one workspace. I’m doing this through a role that has admin access to only the team’s workspace.

Below are the steps I took to set up Geoserver, steps to reproduce the bug, and full error message.

Setting up the environment

  1. Clear all pre-loaded workspaces from geoserver
  2. Create a workspace named ‘shared’ as the default workspace
  3. Enable the ‘shared’ workspace
  4. Create a workspace named ‘student0workspace’. Do not make it the default workspace
  5. Enable the ‘student0workspace’ workspace
  6. Add a new role named ‘student0role’
  7. Add a new user named ‘student0’ and give it the ‘student0role’ role.
  8. Add three new data security rules that give ‘student0role’ read, write, and admin access to ‘student0workspace’.
  9. Make sure the catalog mode is set to Hide.

Reproducing the bug

  1. Log in as ‘student0’
  2. Add a new shapefile store. Name it ‘states_store’ and publish the states.shp file under data > shapefiles
  3. Click publish for the states layer
  4. Fill in the Declared SRS and attempt to calculate the native bounding box (‘Compute from data’). The following error will occur in the geoserver error log (full error message at the end): “Error computing the native BBOX java.io.IOException: Schema ‘student0workspace:states’ does not exist.”

Note: interestingly enough, if while stuck on step 4, the workspace configuration is re-opened and saved in another tab (even without any changes), the layer will publish properly (assuming a style is created in the workspace and selected under the publishing tab).

2016-02-15 17:41:06,628 ERROR [data.resource] - Error computing the native BBOX
java.io.IOException: Schema ‘student0workspace:states’ does not exist.
at org.geotools.data.store.ContentDataStore.ensureEntry(ContentDataStore.java:621)
at org.geotools.data.store.ContentDataStore.getFeatureSource(ContentDataStore.java:393)
at org.geotools.data.store.ContentDataStore.getFeatureSource(ContentDataStore.java:687)
at org.geoserver.catalog.ResourcePool.getFeatureSource(ResourcePool.java:1183)
at org.geoserver.catalog.impl.FeatureTypeInfoImpl.getFeatureSource(FeatureTypeInfoImpl.java:125)
at org.geoserver.catalog.CatalogBuilder.getNativeBounds(CatalogBuilder.java:561)
at org.geoserver.catalog.CatalogBuilder.getNativeBounds(CatalogBuilder.java:543)
at org.geoserver.web.data.resource.BasicResourceConfig$1.onSubmit(BasicResourceConfig.java:120)
at org.apache.wicket.ajax.markup.html.form.AjaxSubmitLink$1.onSubmit(AjaxSubmitLink.java:68)
at org.apache.wicket.ajax.form.AjaxFormSubmitBehavior.onEvent(AjaxFormSubmitBehavior.java:143)
at org.apache.wicket.ajax.AjaxEventBehavior.respond(AjaxEventBehavior.java:177)
at org.apache.wicket.ajax.AbstractDefaultAjaxBehavior.onRequest(AbstractDefaultAjaxBehavior.java:300)
at org.apache.wicket.request.target.component.listener.BehaviorRequestTarget.processEvents(BehaviorRequestTarget.java:119)
at org.apache.wicket.request.AbstractRequestCycleProcessor.processEvents(AbstractRequestCycleProcessor.java:92)
at org.apache.wicket.RequestCycle.processEventsAndRespond(RequestCycle.java:1250)
at org.apache.wicket.RequestCycle.step(RequestCycle.java:1329)
at org.apache.wicket.RequestCycle.steps(RequestCycle.java:1436)
at org.apache.wicket.RequestCycle.request(RequestCycle.java:545)
at org.apache.wicket.protocol.http.WicketFilter.doGet(WicketFilter.java:484)
at org.apache.wicket.protocol.http.WicketServlet.doPost(WicketServlet.java:160)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at org.springframework.web.servlet.mvc.ServletWrappingController.handleRequestInternal(ServletWrappingController.java:159)
at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:789)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
at org.geoserver.filters.ThreadLocalsCleanupFilter.doFilter(ThreadLocalsCleanupFilter.java:28)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:75)
at org.geoserver.wms.animate.AnimatorFilter.doFilter(AnimatorFilter.java:71)
at org.geoserver.filters.SpringDelegatingFilter$Chain.doFilter(SpringDelegatingFilter.java:71)
at org.geoserver.filters.SpringDelegatingFilter.doFilter(SpringDelegatingFilter.java:46)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.platform.AdvancedDispatchFilter.doFilter(AdvancedDispatchFilter.java:50)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:87)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:42)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:48)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:44)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:726)
at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:206)
at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
at org.mortbay.jetty.Server.handle(Server.java:324)
at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:505)
at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:842)
at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:648)
at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:380)
at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:395)
at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:450)

Add Comment

Add Comment

This message was sent by Atlassian JIRA (v7.2.0-OD-01-031#72000-sha1:c6b05a6)

Atlassian logo