Image asset permissions

[S Kindrat]

Hello,

I am trying to get a hippo portal set up, and while I've got to the point
where I have a very basic page working, I've got myself stuck on retrieving
some data I've put in using the CMS (so I figured it would be best to post
it to this group, since the problem has nothing to do with Hippo Portal)

What it comes down to is I have a 'Text Page' asset in my repository called
home.  Using the editor, I inserted an image (since our editors will be
using that functionality).  I found out that I needed to do some URL
manipulation, so I'm proxying the requests to point straight to the preview
repository for the /binaries.  This works just fine, if I am logged into the
CMS as a user.  Problem is, our portal is going to allow anonymous access,
and unless you are logged in, you get a "Resource not found" error message.


Is there any way to make the binaries public?  Or have I missed something
with regards to anonymous users?  I have to admit, I have not seen anything
about setting up an anonymous user at all with this software, so it could be
I've missed something.

Using Hippo CMS 6.05.04, I have looked through all the permissions as the
root user, and have seen nothing about anonyomous or unauthenticated.

Any help would be appreciated.
********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html

[Bartosz Oudekerk-2]

S Kindrat wrote:
> Is there any way to make the binaries public?  Or have I missed something
> with regards to anonymous users?  I have to admit, I have not seen anything
> about setting up an anonymous user at all with this software, so it could be
> I've missed something.
>
> Using Hippo CMS 6.05.04, I have looked through all the permissions as the
> root user, and have seen nothing about anonyomous or unauthenticated.

There is no anonymous user as such, but there's a default user called
siteuser (with passwd siteuser), which has read-only rights on the
repository. That's the user you should use for your site/portal.

Regards,
Bartosz
********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html

[S Kindrat]

Right, and siteuser works fine for the portal.  So I guess my question is,
how would I display images in the repository (for example,
/binaries/documents/home/testimage.jpg).  I was able to access it through
http://<server>:50000/assetspreview/binaries/documents/home/testimage.jpg
and http://<server>:50000/binaries/documents/home/testimage.jpg, if, and
only if, I'm logged into the CMS.  I am also able to access it directly
through port 60000, which has basic http authentication, and works fine with
siteuser.

I tried setting up a ProxyPass rule in apache, but it doesn't seem to work
with http://siteuser:<password>@<server>:60000/default/files/default.preview/binaries/<etc>,
where it still prompts for the username and password.  (I tried the
http://siteuser:pass@server:60000/default/<etc> directly in a new web
browser (no authentication) and it works fine that way)

These are the rules I have so far:
# Binaries rules
ProxyPass /binaries/ http://siteuser
:<password>@localhost:60000/default/files/default.preview/binaries/
ProxyPassReverse /binaries/ http://siteuser
:<password>@localhost:60000/default/files/default.preview/binaries/
# Portal application
ProxyPass / http://localhost:8080/ourportal/portal/
ProxyPassReverse / http://localhost:8080/ourportal/portal/

As I said, I'm seeing no support for hard coding the user/pass into the URLs
in the proxy rules.  Am I on the right track going the route of
proxy/rewriting, or is there an easier way?

Thanks

Shawn

On Tue, Oct 7, 2008 at 8:48 PM, Bartosz Oudekerk <b.oudekerk@...>wrote:

> S Kindrat wrote:
>
>> Is there any way to make the binaries public?  Or have I missed something
>> with regards to anonymous users?  I have to admit, I have not seen
>> anything
>> about setting up an anonymous user at all with this software, so it could
>> be
>> I've missed something.
>>
>> Using Hippo CMS 6.05.04, I have looked through all the permissions as the
>> root user, and have seen nothing about anonyomous or unauthenticated.
>>
>
> There is no anonymous user as such, but there's a default user called
> siteuser (with passwd siteuser), which has read-only rights on the
> repository. That's the user you should use for your site/portal.
>
> Regards,
> Bartosz
> ********************************************
> Hippocms-dev: Hippo CMS development public mailinglist
>
> Searchable archives can be found at:
> MarkMail: http://hippocms-dev.markmail.org
> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>
>

********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html

[Jeroen Reijn-3]

Hi Shawn,

I guess the question here is: Where do you want to render the images?

- In your portal front-end?
- In your CMS ?
- Or somewhere else?

The portal should have build-in support for rendering images from the
repository.

Regards,

Jeroen



S Kindrat wrote:

> Right, and siteuser works fine for the portal.  So I guess my question is,
> how would I display images in the repository (for example,
> /binaries/documents/home/testimage.jpg).  I was able to access it through
> http://<server>:50000/assetspreview/binaries/documents/home/testimage.jpg
> and http://<server>:50000/binaries/documents/home/testimage.jpg, if, and
> only if, I'm logged into the CMS.  I am also able to access it directly
> through port 60000, which has basic http authentication, and works fine with
> siteuser.
>
> I tried setting up a ProxyPass rule in apache, but it doesn't seem to work
> with http://siteuser:<password>@<server>:60000/default/files/default.preview/binaries/<etc>,
> where it still prompts for the username and password.  (I tried the
> http://siteuser:pass@server:60000/default/<etc> directly in a new web
> browser (no authentication) and it works fine that way)
>
> These are the rules I have so far:
> # Binaries rules
> ProxyPass /binaries/ http://siteuser
> :<password>@localhost:60000/default/files/default.preview/binaries/
> ProxyPassReverse /binaries/ http://siteuser
> :<password>@localhost:60000/default/files/default.preview/binaries/
> # Portal application
> ProxyPass / http://localhost:8080/ourportal/portal/
> ProxyPassReverse / http://localhost:8080/ourportal/portal/
>
> As I said, I'm seeing no support for hard coding the user/pass into the URLs
> in the proxy rules.  Am I on the right track going the route of
> proxy/rewriting, or is there an easier way?
>
> Thanks
>
> Shawn
>
> On Tue, Oct 7, 2008 at 8:48 PM, Bartosz Oudekerk <b.oudekerk@...>wrote:
>
>> S Kindrat wrote:
>>
>>> Is there any way to make the binaries public?  Or have I missed something
>>> with regards to anonymous users?  I have to admit, I have not seen
>>> anything
>>> about setting up an anonymous user at all with this software, so it could
>>> be
>>> I've missed something.
>>>
>>> Using Hippo CMS 6.05.04, I have looked through all the permissions as the
>>> root user, and have seen nothing about anonyomous or unauthenticated.
>>>
>> There is no anonymous user as such, but there's a default user called
>> siteuser (with passwd siteuser), which has read-only rights on the
>> repository. That's the user you should use for your site/portal.
>>
>> Regards,
>> Bartosz
>> ********************************************
>> Hippocms-dev: Hippo CMS development public mailinglist
>>
>> Searchable archives can be found at:
>> MarkMail: http://hippocms-dev.markmail.org
>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>
>>
> ********************************************
> Hippocms-dev: Hippo CMS development public mailinglist
>
> Searchable archives can be found at:
> MarkMail: http://hippocms-dev.markmail.org
> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>

********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html

[S Kindrat]

In the portal front-end.  I noticed in
${tomcat.home}/webapps/ourportal/WEB-INF/web.xml the following:
  <servlet-mapping>
    <servlet-name>CMSResourceServlet</servlet-name>
    <url-pattern>/binaries/*</url-pattern>
  </servlet-mapping>

so, I took out all the proxy rules, and now, am getting a 404 error on the
image itself, a 403 error on http://servername.com:8080/ourportal/binaries/,
and 404's on everything in between (all produced by tomcat).  Since the
portal should have built-in support, should I move this discussion to the
hippoportal-dev list?

On Wed, Oct 8, 2008 at 11:20 AM, Jeroen Reijn <j.reijn@...> wrote:

> Hi Shawn,
>
> I guess the question here is: Where do you want to render the images?
>
> - In your portal front-end?
> - In your CMS ?
> - Or somewhere else?
>
> The portal should have build-in support for rendering images from the
> repository.
>
> Regards,
>
> Jeroen
>
>
>
>
> S Kindrat wrote:
>
>> Right, and siteuser works fine for the portal.  So I guess my question is,
>> how would I display images in the repository (for example,
>> /binaries/documents/home/testimage.jpg).  I was able to access it through
>> http://<server>:50000/assetspreview/binaries/documents/home/testimage.jpg
>> and http://<server>:50000/binaries/documents/home/testimage.jpg, if, and
>> only if, I'm logged into the CMS.  I am also able to access it directly
>> through port 60000, which has basic http authentication, and works fine
>> with
>> siteuser.
>>
>> I tried setting up a ProxyPass rule in apache, but it doesn't seem to work
>> with http://siteuser
>> :<password>@<server>:60000/default/files/default.preview/binaries/<etc>,
>> where it still prompts for the username and password.  (I tried the
>> http://siteuser:pass@server:60000/default/<etc> directly in a new web
>> browser (no authentication) and it works fine that way)
>>
>> These are the rules I have so far:
>> # Binaries rules
>> ProxyPass /binaries/ http://siteuser
>> :<password>@localhost:60000/default/files/default.preview/binaries/
>> ProxyPassReverse /binaries/ http://siteuser
>> :<password>@localhost:60000/default/files/default.preview/binaries/
>> # Portal application
>> ProxyPass / http://localhost:8080/ourportal/portal/
>> ProxyPassReverse / http://localhost:8080/ourportal/portal/
>>
>> As I said, I'm seeing no support for hard coding the user/pass into the
>> URLs
>> in the proxy rules.  Am I on the right track going the route of
>> proxy/rewriting, or is there an easier way?
>>
>> Thanks
>>
>> Shawn
>>
>> On Tue, Oct 7, 2008 at 8:48 PM, Bartosz Oudekerk <b.oudekerk@...
>> >wrote:
>>
>>  S Kindrat wrote:
>>>
>>>  Is there any way to make the binaries public?  Or have I missed
>>>> something
>>>> with regards to anonymous users?  I have to admit, I have not seen
>>>> anything
>>>> about setting up an anonymous user at all with this software, so it
>>>> could
>>>> be
>>>> I've missed something.
>>>>
>>>> Using Hippo CMS 6.05.04, I have looked through all the permissions as
>>>> the
>>>> root user, and have seen nothing about anonyomous or unauthenticated.
>>>>
>>>>  There is no anonymous user as such, but there's a default user called
>>> siteuser (with passwd siteuser), which has read-only rights on the
>>> repository. That's the user you should use for your site/portal.
>>>
>>> Regards,
>>> Bartosz
>>> ********************************************
>>> Hippocms-dev: Hippo CMS development public mailinglist
>>>
>>> Searchable archives can be found at:
>>> MarkMail: http://hippocms-dev.markmail.org
>>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>>
>>>
>>>  ********************************************
>> Hippocms-dev: Hippo CMS development public mailinglist
>>
>> Searchable archives can be found at:
>> MarkMail: http://hippocms-dev.markmail.org
>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>
>>  ********************************************
> Hippocms-dev: Hippo CMS development public mailinglist
>
> Searchable archives can be found at:
> MarkMail: http://hippocms-dev.markmail.org
> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>
>

********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html

[Dennis Dam-2]

Hi Shawn,

the url you should get for accessing binaries from the portal should
look something like this:

/ourportal/binaries/site/binaries/folder1/image1.jpg

where :

/ourportal/binaries is the servlet path you mentioned before
"site" is the identifier of the Site that is configured in hippo-portal.xml
/binaries/folder1/image1.jpg is the path to the binary : this is a path
relative to the .preview folder in the repository.

but .. you should never create this url manually! Instead,  use the url
rewriting functionality provided by Hippo Portal. There are two
components you can use:

1. the LinkFactory object, which you can get by calling
getCMSRequestContext().getLinkFactory() from your portlet
2. the SimpleLinkRewriter object, which wraps the LinkFactory object, so
it can be easily used from an XSLT or FreeMarker template.

I think you need the SimpleLinkRewriter object, since you're
transforming an url in your XML document to a portal url from inside an
XSLT right? An instance of the SimpleLinkRewriter is passed as part of
the XSLT model (XSLt parameters) by default (see the method
createXSLTTransformerModel(..) in [1]). So you don't have to do pass it
as a parameter, just change your XSLt to use that SimpleLinkRewriter to
convert binaries urls to portal urls. Here's an example peice of XSLt
code doing just that:

<xsl:stylesheet
    xmlns:lw="xalan://nl.hippo.portal.cms.site.SimpleLinkRewriter"
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
    exclude-result-prefixes="lw"
    >
   
    <xsl:param name="linkrewriter"/>
   
    <xsl:template match="a|doclink">
        <a>
            <xsl:apply-templates select="." mode="rewrite"/>
            <xsl:apply-templates select="@*[local-name()!='href' and
local-name()!='target']|node()"/>
        </a>
    </xsl:template>
   
    <xsl:template match="*" mode="rewrite">
        <xsl:if test="@href">
            <xsl:variable name="url"
select="lw:rewrite($linkrewriter,string(@href))"/>
            <xsl:attribute name="href"><xsl:value-of
select="$url"/></xsl:attribute>
        </xsl:if>
    </xsl:template>
   
</xsl:stylesheet>


The code uses the Xalan extension feature to use the complex object
SimpleLinkRewriter. The linkrewriter will take care of rewriting
repository urls ( /content/.. or /binaries/.. urls) to portal urls. But
the linkrewriter is not limited to rewriting content urls, you can also
rewrite sitemap urls to portal urls, e.g. :

linkrewriter.rewrite("sitemap:/department1/news");

will create a portal url like

/ourportal/portal/site/department1/news


It's also possible to generate urls by referencing a unique ID of a
sitemap item in your sitemap. E.g. if you have the following sitemap
item in your sitemap:

<fixed-item id="aboutPage" src="/content/about/content.xml"
name="aboutPage"/>

then you can create a portal url for that by calling:

linkrewriter.rewrite("sitemap:id:aboutPage");

this will result in the url:

/ourportal/portal/site/about

Notice that the "name" attribute of the fixed-item shows up in the url.

The linkrewriter is also passed as a parameter "linkrewriter" to a
FreeMarker template, which is even more straightforward to use.

hth
Dennis

[1]
http://svn.hippocms.org/repos/hippo/hippo-portal/branches/PORTAL-1.10.xx-branch/hippo-portal-pac/src/main/java/nl/hippo/portal/cms/portlets/BaseContentPortlet.java


PS. I cross-posted this mail to the hippo-portal-dev list, because it
can be useful for other Hippo-Portal developers as well.

S Kindrat wrote:

> In the portal front-end.  I noticed in
> ${tomcat.home}/webapps/ourportal/WEB-INF/web.xml the following:
>   <servlet-mapping>
>     <servlet-name>CMSResourceServlet</servlet-name>
>     <url-pattern>/binaries/*</url-pattern>
>   </servlet-mapping>
>
> so, I took out all the proxy rules, and now, am getting a 404 error on the
> image itself, a 403 error on http://servername.com:8080/ourportal/binaries/,
> and 404's on everything in between (all produced by tomcat).  Since the
> portal should have built-in support, should I move this discussion to the
> hippoportal-dev list?
>
> On Wed, Oct 8, 2008 at 11:20 AM, Jeroen Reijn <j.reijn@...> wrote:
>
>  
>> Hi Shawn,
>>
>> I guess the question here is: Where do you want to render the images?
>>
>> - In your portal front-end?
>> - In your CMS ?
>> - Or somewhere else?
>>
>> The portal should have build-in support for rendering images from the
>> repository.
>>
>> Regards,
>>
>> Jeroen
>>
>>
>>
>>
>> S Kindrat wrote:
>>
>>    
>>> Right, and siteuser works fine for the portal.  So I guess my question is,
>>> how would I display images in the repository (for example,
>>> /binaries/documents/home/testimage.jpg).  I was able to access it through
>>> http://<server>:50000/assetspreview/binaries/documents/home/testimage.jpg
>>> and http://<server>:50000/binaries/documents/home/testimage.jpg, if, and
>>> only if, I'm logged into the CMS.  I am also able to access it directly
>>> through port 60000, which has basic http authentication, and works fine
>>> with
>>> siteuser.
>>>
>>> I tried setting up a ProxyPass rule in apache, but it doesn't seem to work
>>> with http://siteuser
>>> :<password>@<server>:60000/default/files/default.preview/binaries/<etc>,
>>> where it still prompts for the username and password.  (I tried the
>>> http://siteuser:pass@server:60000/default/<etc> directly in a new web
>>> browser (no authentication) and it works fine that way)
>>>
>>> These are the rules I have so far:
>>> # Binaries rules
>>> ProxyPass /binaries/ http://siteuser
>>> :<password>@localhost:60000/default/files/default.preview/binaries/
>>> ProxyPassReverse /binaries/ http://siteuser
>>> :<password>@localhost:60000/default/files/default.preview/binaries/
>>> # Portal application
>>> ProxyPass / http://localhost:8080/ourportal/portal/
>>> ProxyPassReverse / http://localhost:8080/ourportal/portal/
>>>
>>> As I said, I'm seeing no support for hard coding the user/pass into the
>>> URLs
>>> in the proxy rules.  Am I on the right track going the route of
>>> proxy/rewriting, or is there an easier way?
>>>
>>> Thanks
>>>
>>> Shawn
>>>
>>> On Tue, Oct 7, 2008 at 8:48 PM, Bartosz Oudekerk <b.oudekerk@...
>>>      
>>>> wrote:
>>>>        
>>>  S Kindrat wrote:
>>>      
>>>>  Is there any way to make the binaries public?  Or have I missed
>>>>        
>>>>> something
>>>>> with regards to anonymous users?  I have to admit, I have not seen
>>>>> anything
>>>>> about setting up an anonymous user at all with this software, so it
>>>>> could
>>>>> be
>>>>> I've missed something.
>>>>>
>>>>> Using Hippo CMS 6.05.04, I have looked through all the permissions as
>>>>> the
>>>>> root user, and have seen nothing about anonyomous or unauthenticated.
>>>>>
>>>>>  There is no anonymous user as such, but there's a default user called
>>>>>          
>>>> siteuser (with passwd siteuser), which has read-only rights on the
>>>> repository. That's the user you should use for your site/portal.
>>>>
>>>> Regards,
>>>> Bartosz
>>>> ********************************************
>>>> Hippocms-dev: Hippo CMS development public mailinglist
>>>>
>>>> Searchable archives can be found at:
>>>> MarkMail: http://hippocms-dev.markmail.org
>>>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>>>
>>>>
>>>>  ********************************************
>>>>        
>>> Hippocms-dev: Hippo CMS development public mailinglist
>>>
>>> Searchable archives can be found at:
>>> MarkMail: http://hippocms-dev.markmail.org
>>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>>
>>>  ********************************************
>>>      
>> Hippocms-dev: Hippo CMS development public mailinglist
>>
>> Searchable archives can be found at:
>> MarkMail: http://hippocms-dev.markmail.org
>> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>>
>>
>>    
> ********************************************
> Hippocms-dev: Hippo CMS development public mailinglist
>
> Searchable archives can be found at:
> MarkMail: http://hippocms-dev.markmail.org
> Nabble: http://www.nabble.com/Hippo-CMS-f26633.html
>
>  

********************************************
Hippocms-dev: Hippo CMS development public mailinglist

Searchable archives can be found at:
MarkMail: http://hippocms-dev.markmail.org
Nabble: http://www.nabble.com/Hippo-CMS-f26633.html