<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Sprechblasentext Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Dear all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-GB">I have noticed a strange behaviour in Geonode 2.10 and was wondering, if anyone had the same. For it seems to me potentially a security issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">We have a test system setup including a data layer and two users:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Data layer: Vector data imported via Geonode GUI (drag&drop)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Admin user: uploaded the data and owns it<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">User1: has the right to see and download the data layer<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Now the following behaviour can be noticed (tested in Chroem and Firefox)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">If I open my startpage and login as “user1”, I see the data layer thumbnail (Vector overlay and map background), If I select the layer for detailed viewing, only the map background is displayed, but not the vector layer<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Now I log the “user1” out<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I log immediately in as “admin”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">If I view the data layer as “admin”, I have the same behaviour as above, map background, but no vetor overlay<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">If I open the Geoserver GUI via the Geonode Admin in a new browser tab, I see the Geoserver Admin GUI but strangely logged in as “user1”!!!!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">If I logout and log in again in Geosver GUI as admin, the data layer is then displayed in Geonode, after a reload of the page<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">This seems very odd. Anything related to cookies?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Any help appreciated to make sure this is no security issue<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Oliver<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-GB">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#E2001A;mso-fareast-language:DE"><a href="https://www.intergeo.de/intergeo-en/index.php"><span style="color:#E2001A">Intergeo</span></a> 2019: 17th - 19th
September 2019, Stuttgart, Germany.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#E2001A;mso-fareast-language:DE">Meet us at booth F1.050 in hall 1!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:white;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:white;mso-fareast-language:DE"><img border="0" width="623" height="6" id="Bild_x0020_1" src="cid:image001.png@01D5720C.43F45E00" alt="cid:image002.png@01CD642E.9C14BB50"></span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:white;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#002060;mso-fareast-language:DE"><img border="0" width="95" height="60" id="Bild_x0020_2" src="cid:image002.gif@01D5720C.43F45E00" alt="cid:image002.gif@01CBBECE.B2C97A40"></span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-GB">Oliver Buck<br>
MSc Environmental Science<br>
<br>
E F T A S Fernerkundung<br>
Technologietransfer GmbH<br>
Oststraße 2-18<br>
48145 Münster<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-GB">Fon: +49 251 13307-57 E-Mail:
</span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#E2001A;mso-fareast-language:EN-GB"><a href="mailto:oliver.buck@eftas.com"><span style="color:#E2001A">oliver.buck@eftas.com</span></a></span><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-GB"><br>
Fax: +49 251 13307-33 Web: <a href="http://www.eftas.com/" title="blocked::http://www.eftas.com/">
<span style="color:#E2001A">http://www.eftas.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-GB">Geschäftsführer:<br>
Dipl.-Ing. Georg Altrogge<br>
<br>
Sitz der Gesellschaft: Münster<br>
Amtsgericht Münster, HRB 2999<br>
USt.-IdNr. DE 126038986<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:white;mso-fareast-language:EN-GB">******************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:DE"><img border="0" width="623" height="21" id="Bild_x0020_3" src="cid:image003.png@01D5720C.43F45E00" alt="cid:image006.png@01CD642E.9C14BB50"></span><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="Rectangle_x0020_7" o:spid="_x0000_s1026" type="#_x0000_t75" style='position:absolute;margin-left:.6pt;margin-top:.75pt;width:467.45pt;height:15.85pt;z-index:251659264;visibility:visible;mso-wrap-style:square;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9.02pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:page;mso-height-relative:page'>
<v:imagedata src="cid:image004.png@01D5720C.43F45E00" o:title="" cropbottom="-416f" cropright="-28f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><![endif]--><![if !vml]><span style="mso-ignore:vglayout">
<table cellpadding="0" cellspacing="0" align="left">
<tbody>
<tr>
<td width="1" height="1"></td>
</tr>
<tr>
<td></td>
<td><img width="623" height="21" src="cid:image006.png@01D5720C.AC096AD0" v:shapes="Rectangle_x0020_7"></td>
</tr>
</tbody>
</table>
</span><![endif]><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>