Hi! I'm thinking about forms security. I realized that all the
post-mapping data and all client side checks can be spoofed. For
example, there is an ability to select multiple roles in a particular
form. Then on the form.onload event I put the
form.interceptAction("Submit", "around", fund) function that is called
when a user press the "Submit" button. In the "func" function I get all
roles selected by user and put them to the special hidden field
separated by a delimiter. In this case a cheater can add any role to
that field and WF grants all roles as the cheater wants.
The solution is to double check critical cases on the server side and
don't let the form to be submitted until the server side check allows
it. As I understand there is no way to make a server side check when the
invocation.proceed() function called. So the question is how to handle
this case? What are you thinking about this case?
As for now I see the only way to workaround this. It is needed to put
additional mapping activities "checkers" that will check a post-mapping
data after start/approval activities. And if those checkers detect
something wrong then send an email to admin and pause WF until
proceedings make situation clear.

hello_amigo's Profile: https://forums.netiq.com/member.php?userid=211
View this thread: https://forums.netiq.com/showthread.php?t=48073