[opencms-dev] How to make CmsObject use offline project insteadofonline (createSibling problem)?

[Jonathan Woods]

I agree completely.

I've dug around in the OpenCms initialisation code, and things look a bit
more rosy.  In OpenCmsCore.initConfiguration(...), an admin instance of
CmsObject is first created, and then effectively cloned in order to be
passed to the initialize(...) method of each manager including the
CmsModuleManager.  It's the cloning which is interesting, and it's carried
out in method OpenCmsCore.initCmsObject(...) (several forms).  The source
code comments even point out that this is done to avoid the case in which
something retains a reference to the CmsObject instance given as a
parameter.

So, it looks more likely that it would be safe to use the CmsObject
reference passed in on initialisation.  And even if it wasn't, you might
still be able to 'clone' it yourself and store the new instance.  There are
probably some security restrictions to get round, but it doesn't look
impossible.

Jon

-----Original Message-----
From: opencms-dev-bounces at opencms.org
[mailto:opencms-dev-bounces at opencms.org] On Behalf Of Andras Balogh
Sent: 23 May 2006 14:27
To: The OpenCms mailing list
Subject: Re: [opencms-dev] How to make CmsObject use offline project
insteadofonline (createSibling problem)?

Hello Jon,

Jonathan Woods wrote:

>Jani -
>
>The notion of the 'current project' is part of the CMS session state, 
>just as is the 'current site root'.  The session state is modelled in 
>CmsRequestContext, which itself is accessible from an instance of 
>CmsObject, so you can set the current project thus:
>
>CmsProject project = _cms.readProject(<name of the offline project>);
>
>/*
>or use the method variation which takes an int project id; is either 3 
>or 4 for Offline; I forget which, and I forget how to obtain this 
>safely for any default installation...
>CmsProject = _cms.readProject(3);
>*/
>
>_cms.getRequestContext().setCurrentProject(project);
>
>....
>
>// Get instances of CmsObject from static method on class OpenCms.
>// Means shown is standard way of initialising without needing to know 
>credentials.
>CmsObject cmsObject =
>OpenCms.initCmsObject(OpenCms.getDefaultUsers().getUserGuest());
>
>// Then log in the CmsObject instance as the Admin user.
>
>cmsObject.loginUser("Admin", "admin password here");
>  
>

The problem with this approach that you need to hardcode the password of the
Admin user.
If You develop for a client he may have the requirement or wish to have the
password in his hands so he can change it let's say every month or so.

It would be very good if the OpenCMS experts could say if is SAFE to use the
CmsObject

received from I_CmsModuleAction.initialize or not.



>/* Other stuff necessary - including setting current project and 
>current site root; then you can use cmsObject freely.
>*/
>
>Jon
>  
>
Best regards,
Andras.

_______________________________________________
This mail is sent to you from the opencms-dev mailing list To change your
list options, or to unsubscribe from the list, please visit
http://lists.opencms.org/mailman/listinfo/opencms-dev