-
Type:
Bug
-
Status: Closed
-
Resolution: Fixed
-
Affects Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2
-
Fix Version/s: 6.1.2 CE GA3, 6.1.30 EE GA3, 6.2.0 CE M3
-
Component/s: Accessibility, Application Security > PACL, Security Vulnerability
-
Labels:
-
Environment:liferay 6.1.1
-
Branch Version/s:6.1.x
-
Backported to Branch:Committed
-
Fix Priority:5
-
Git Pull Request:
I have portlet with some entities generated by Service Builder and trying to display list of this entries with using search container.
I've got error:
20:30:38,990 ERROR [http-bio-8080-exec-3][BeanPropertiesImpl:337] java.lang.SecurityException: Attempted to access declared members
java.lang.SecurityException: Attempted to access declared members
at com.liferay.portal.security.pacl.checker.BaseChecker.throwSecurityException(BaseChecker.java:259)
at com.liferay.portal.security.pacl.checker.RuntimeChecker.checkPermission(RuntimeChecker.java:71)
at com.liferay.portal.security.pacl.ActivePACLPolicy.checkPermission(ActivePACLPolicy.java:55)
at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:103)
at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:74)
at java.lang.SecurityManager.checkMemberAccess(SecurityManager.java:1662)
at java.lang.Class.checkMemberAccess(Class.java:2157)
at java.lang.Class.getDeclaredMethods(Class.java:1790)
at jodd.util.ReflectUtil.getAccessibleMethods(ReflectUtil.java:297)
at jodd.util.ReflectUtil.getAccessibleMethods(ReflectUtil.java:281)
at jodd.introspector.ClassDescriptor.inspectProperties(ClassDescriptor.java:338)
at jodd.introspector.ClassDescriptor.getBeanGetter(ClassDescriptor.java:431)
at jodd.bean.BeanUtilBean.getSimpleProperty(BeanUtilBean.java:123)
at jodd.bean.BeanUtilBean.getIndexProperty(BeanUtilBean.java:250)
at jodd.bean.BeanUtilBean.getProperty(BeanUtilBean.java:482)
at jodd.bean.BeanUtil.getProperty(BeanUtil.java:111)
at com.liferay.portal.bean.BeanPropertiesImpl.getObject(BeanPropertiesImpl.java:334)
at com.liferay.portal.bean.BeanPropertiesImpl.getObject(BeanPropertiesImpl.java:326)
at com.liferay.portal.kernel.bean.BeanPropertiesUtil.getObject(BeanPropertiesUtil.java:163)
at com.liferay.taglib.ui.SearchContainerRowTag.processRow(SearchContainerRowTag.java:297)
at com.liferay.taglib.ui.SearchContainerRowTag.doAfterBody(SearchContainerRowTag.java:95)
Line
at com.liferay.taglib.ui.SearchContainerRowTag.processRow(SearchContainerRowTag.java:297)
is
Object primaryKeyObj = BeanPropertiesUtil.getObject(
model, _keyProperty);
"model" here is my model implementation: ru.emdev.timetracking.model.impl.TimeTrackingEntryModelImpl
I've tried to add it into security-manager-get-bean-property - but it does not help to avoid this problem.
Is search container working with PACL enabled? Is it possible to use own models with PACL?