Form "test" urls, form persistence API and 401 Not Authorised response

I have an implementation of the persistence API and have a small problem when it returns a 401 Not Authorised response. Orbeon seems to be ignoring the response and attempts to use the error page contents as a valid form. Then I get various errors depending on the error page I have installed. I get a form displayed if I make the error page contents a valid form template.

This seems to only occur with a "test" url for viewing a template such as

/orbeon/fr/orbeon/builder/test/261:17

brian...

On Sunday, January 31, 2016, bwallis42 <[hidden email]> wrote:

I have an implementation of the persistence API and have a small problem when
it returns a 401 Not Authorised response. Orbeon seems to be ignoring the
response and attempts to use the error page contents as a valid form. Then I
get various errors depending on the error page I have installed. I get a
form displayed if I make the error page contents a valid form template.

This seems to only occur with a "test" url for viewing a template such as

/orbeon/fr/orbeon/builder/test/261:17

brian...



--
View this message in context: http://discuss.orbeon.com/Form-test-urls-form-persistence-API-and-401-Not-Authorised-response-tp4660989.html
Sent from the Orbeon Forms community mailing list mailing list archive at Nabble.com.

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to <a href="javascript:;" onclick="_e(event, &#39;cvml&#39;, &#39;orbeon+unsubscribe@googlegroups.com&#39;)">orbeon+unsubscribe@....
To post to this group, send email to <a href="javascript:;" onclick="_e(event, &#39;cvml&#39;, &#39;orbeon@googlegroups.com&#39;)">orbeon@....

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].

Sorry, I'm being a bit confusing. The template ID on the URL is one of our own. We replace the generated UUID ids with our own persistence ids. In this case the id is referring to version 17 of form template 216.

The IDs are passed through orbeon to our persistence API where they are interpreted. We discussed this a while back, http://discuss.orbeon.com/unique-persistence-ids-td4659101.html and our final solution was to replace the generated IDs in our persistence layer so that when you do a search you get a list of forms or templates back that include our ID not the original one. This seems to work well.

Hi Brian,

Got it. Two things:

- /fr/orbeon/builder/test/{docid} isn't used or supported. It might have been done to be able to view a form from the Form Builder summary page, but this isn't a feature we currently have. (Even if it could make sense to add it in the future.)

- Form Builder incorrectly applies permissions when you do "test", and as a result a form author might to be able to test the form she's creating. This is covered by the issue 2050. Obviously, a workaround is to make sure that form authors also have the permission to access the form they create, at least in their dev environment.

https://github.com/orbeon/orbeon-forms/issues/2050

Does this help?

Alex