Products | Versions |
---|---|
TIBCO DataSynapse GridServer | 7.0.0 |
When we try to share the URL of the Service Session Admin page where we search by session ID or other criteria and it's not showing the expected result. When a user follows the shared link it opens the default page saying "Welcome, admin. You are logged into the Manager".
This issue occurs only when we disabled the XSSFilter and CSRF filter from the security tab
Steps to reproduce the issue:-
1.) Make sure XSSFilter & CSRF filter are enabled.
2.) Run the Linpack test, and search for a session.
3.) Copy the URL from the browser's address bar and open a new tab and paste the URL.
4.) The user sees the welcome page, instead of the session.
5.) Disable XSSFilter & CSRF filter and the searched session can be seen.
Expected results:-
As it is not a different domain in URL (not cross scripting) So expected behavior is to work without disabling XSSFilter & CSRF filter
Pre-requisites:
Installed JDK
Gridserver 7.x
Gridserver Engine
Install Gridserver
Step 1:
Navigate to Installation Directory>> datasynapse >>manager>>webapps>>livecluster>>WEB-INF>>config>>xss.xml
Step 2:
Add Following Block Code within <csrfURLs> block :
<url>/livecluster/(admin|manage)/job/jobView2.jsp</url>
<url>/livecluster/(admin|manage)/control/job/jobAdmin.jsp</url>
Snapshot for reference:
Please refer xss.xml from attachment
Step 3:
Restart The server.
Now User Can share the link for Search Results by any criteria and View Service Session