Category: Content Management

Enterprise Content Management (ECM), Web Content Management (WCM), Document Management (DM). Whatever you call it this category covers market happenings and lessons learned.

April 27, 2012

Alfresco security alert

Both Alfresco Enterprise and Community Edition users need to pay attention to the security alert that went out last night. In a nutshell, two serious security issues (ALF-13721, ALF-13726) that could be exploited in order to gain unauthorized access to your repository and the content within it have been discovered and addressed.

ALF-13721 refers to an issue that the SOLR API webscripts can be executed without authentication. If you are running Alfresco 4, this affects you, even if you have not installed or configured SOLR. The issue is addressed in 4.0.1 Enterprise. A hotfix is available for 4.0.

ALF-13726 is about exploiting the XSLT engine’s ability to run arbitrary Java classes which could be used to grant someone access to the repository. This one affects all versions of Alfresco. This issue will be addressed in 3.4.9. A hotfix is available.

Community Edition users should be able to patch these issues themselves using information provided in the Jiras and forum post referenced above. The fixes will be incorporated into the next Community release.

April 19, 2012

How to suggest or propose a DevCon 2012 talk

If you want to give a talk at DevCon, here are your options:

Read the call for papers, then submit a proposal for a traditional session no later than May 19
Come to the conference and sign up for a Lightning Talk
Come to the conference and participate in a Birds-of-a-Feather session

If you have an idea for a session but you don’t want to speak, reply to this thread in the forums with your idea and maybe it will inspire someone else to give the talk.

April 17, 2012

Alfresco DevCon 2012: San Jose & Berlin

Last week I announced that Alfresco DevCon 2012 will be in Berlin and San Jose. We’ll be at the Berlin Hilton November 5, 6, & 7 and at the San Jose Marriott & Convention Center November 13, 14, & 15. Eagle-eyed readers who saw the announcement last week will note that the Berlin date has changed. The DMS Expo conference in Stuttgart conflicted with our dates so we’re moving to give everyone the maximum opportunity to Experience DevCon Awesomeness.

In both cities, the first day of the conference is an optional training day. We’re still working out exactly which classes will be offered on the training day, but we are increasing capacity this year due to popular demand.

Like last year, the main conference days will feature keynotes from Alfresco leadership, some great sessions from Alfresco Engineers, partners, and other members of the community, and plenty of opportunities for networking.

I’m finalizing tracks right now. As soon as I’m done, I’ll post the call for papers. I expect you to unleash a flood of outstanding conference submissions.

If you need some inspiration, take a look at the DevCon 2011 presentations on slideshare.

I typically post DevCon related news here but you might also want to follow the DevCon blog as well.

April 2, 2012

Alfresco forum users on a map & some forum stats for March

I think this is kind of cool. It’s a map that shows the Alfresco English-language forums users.

(Click to enlarge)

I love how global our community is! If your location isn’t represented, it is because either I couldn’t look up your location by IP address or you don’t have your location set in your forum profile. Telling us a bit about who you are is useful beyond map-making–it can help with event planning, for example. And maybe you’ll find someone nearby with similar interests. So why not update your location while you’re thinking about it?

Looking at the map, I guess my biggest question is: What gives, Iceland? You keeping all of that good Alfresco knowledge to yourself or what?

While I’m on the subject, I should probably mention that the top users in terms of number of posts for March were (in alphabetic order):

AFaust
Andy
Ashex
BillyBoy
MikeH
billerby
jordiv
jpotts
mitpatoliya
mrogers

Thank you!

And, if you are looking to help make a dent in unanswered posts, the top forums in descending order of unanswered posts are:

Unanswered posts were below average in February and March, which is great, but there is still room for improvement.

March 7, 2012

Tip: How to move an Alfresco category

Alfresco has a category hierarchy that can be used to categorize content. Unlike tags, which are not in a hierarchy and can be created by anyone, categories must be managed by an administrator. But even an administrator cannot move a category from one parent to another through the user interface. When it is time to reorganize your categories, how do you do it?

It’s actually pretty easy to do this with code. Your first thought might be, “Well, a category is a node and server-side JavaScript can work with nodes, so I’ll just write a quick script to do the move,” and who could blame you–that’s a well-reasoned line of thinking. But if you look at the source for the current JavaScript API ScriptNode object’s “move” method, you’ll see that it assumes that the association it is creating is “cm:contains”. Categories are associated with an association called “cm:subcategories”, not “cm:contains”. So, at least in this release, JavaScript can’t help us.

Luckily, Alfresco’s Java API is up to the task. When you call the NodeService’s moveNode method you have full control over the new relationship that gets created.

For stuff like this it is often handy to whip up a little Java-backed web script. All the web script needs is the source node reference that needs to be moved and a target node reference to move the source node reference to. Here’s the class with debug and parameter checking removed:

public class MoveCategory extends DeclarativeWebScript {

  // Dependencies
  private NodeService nodeService;

  @Override
  protected Map<String, Object> executeImpl(WebScriptRequest req, Status status) {

    final String sourceNodeRefString = req.getParameter("sourceNodeRef");
    final String targetNodeRefString = req.getParameter("targetNodeRef");

    // snag the nodes
    NodeRef sourceNodeRef = new NodeRef(sourceNodeRefString);
    String sourceName = (String) nodeService.getProperty(
                                   sourceNodeRef,
                                   ContentModel.PROP_NAME);
    NodeRef targetNodeRef = new NodeRef(targetNodeRefString);
    String targetName = (String) nodeService.getProperty(
                                   targetNodeRef,
                                   ContentModel.PROP_NAME);

    // move the source node to the target
    nodeService.moveNode(sourceNodeRef,
                         targetNodeRef,
                         ContentModel.ASSOC_SUBCATEGORIES,
                         QName.createQName(
                           NamespaceService.CONTENT_MODEL_1_0_URI,
                           sourceName));

    // set up the model
    Map<String, Object> model = new HashMap<String, Object>();
    model.put("sourceNodeRef", sourceNodeRefString);
    model.put("sourceName", sourceName);
    model.put("targetNodeRef", targetNodeRefString);
    model.put("targetName", targetName);

    return model;
  }

  public void setNodeService(NodeService nodeService) {
    this.nodeService = nodeService;
  }

}

If you need to see how to wire up the web script with Spring configuration, or you want to see the rest of the web script files (like the descriptor & view), you can take a look at this zipped up Eclipse project.

I should mention that in my web script descriptor, I configured the web script to require an authenticated user, but I set it to run as admin. That gives non-admin users the ability to move categories around using this web script. You may or may not want to do that.

Also, because this is just an example, I’m using the zip overlay method of deployment. For production, you should be using AMPs.

For more Java-backed web script examples, see this wiki page. And if you would prefer to use Maven to develop your Java-backed web scripts, take a look at this project on Google Code.

February 29, 2012

Thoughts on the Alfresco forums

Back in 2009 I wrote a post called, “The Alfresco forums need your help.” It was about how I happened to come across the “unanswered posts” page in the Alfresco forums and noticed, to my horror, that it was 40 pages long. I later realized that the site is configured to show no more than 40 pages so it was likely longer.

Now that I’m on the inside I’ve got access to the data. As it turns out, as of earlier this month, in the English forums we had a little over 1100 topics created over the past year that never got a reply. That represents about 27% of all topics created for that period.

Last year I ran a Community Survey that reported that 55% of people have received responses that were somewhat helpful, exactly what they were looking for, or exceeding expectations. A little over 10% received a response that wasn’t helpful. About 34% said they never saw a response. If you look at the actual numbers for the year leading up to the survey, there were about 1500 topics created that never got a reply, which is again about 28% of all topics created for the same period.

That day in 2009 I suggested we start doing “Forum Fridays” to encourage everyone to spend a little time, once a week, helping out in the forums. I kept it up for a while. The important thing for me was that even if I didn’t check in every Friday, I did form a more regular forum habit. It felt good to see my “points” start to climb (you can see everyone’s points on the member list) and I started to feel guilty when I went too long without checking in.

Since joining Alfresco I’ve been in the forums more regularly. In fact, this month, I decided to make February a month for focusing on forums. I spent a significant amount of time in the forums each day with a goal of making a dent in unanswered posts. I also wanted to see if I could understand why posts go unanswered.

Some topics I came across were unanswered because they were poorly-worded, vague, or otherwise indecipherable. I’d say 5% fit this category. More often were the questions that were either going to require significant time reproducing and debugging or were in highly-specialized or niche areas of the platform that just don’t see a lot of use. I’d say 20% fit this category. These are questions that maybe only a handful of people know the answer to. But at least 50% or maybe more were questions a person with even a year or two of experience could answer in 15 minutes or less.

Alfresco is lucky. Our Engineering team spends significant time in the forums. The top posters of all time–Mike Hatfield, Mark Rogers, Kevin Roast, Gavin Cornwell, Andy Hind, David Caruana, Derek Hulley–are the guys that built the platform. Somehow they manage to do that and consistently put up impressive forum numbers. We also have non-Alfrescans that spend a lot of time in the forums racking up significant points. Users such as zaizi, Loftux, OpenPj, savic.prvoslav, and jpfi, just to name a few, are totally crushing it. It isn’t fair or reasonable for me to ask either of these groups to simply spend more time in the forums. And, while I have sincerely enjoyed Focus on Forums February, I’m not a scalable solution. Instead, I’d like to mobilize the rest of you to help.

I think if we put our minds to it, we should be able to address every unanswered post:

Questions that are essentially “bad questions” need a reply with friendly suggestions on how to ask a better question.

Time-consuming questions need at least an initial reply that suggests where on docs.alfresco.com, the wiki, other forum posts, or blogs the person might look to learn more, or even a reply that just says, “What you’re asking can’t easily be answered in a reasonable amount of time because…”. People new to our platform don’t know what is a big deal and what isn’t, so let’s explain it.
Highly-specialized or niche questions should be assigned to someone for follow-up. If you read a question and your first thought is, “Great question, I have absolutely no idea,” your next thought should be, “Who do I know that would?”. Rather than answering the question your job becomes finding the person that does know the answer. Shoot them a link to the thread via email or twitter or IRC. Some commercial open source companies I’ve spoken to about this topic actually assign unanswered posts to Jira tickets. That’s food for thought.
Relatively easy questions have to be answered. Our volume is manageable. We tend to get about 400 new topics each month with 100 remaining unanswered, on average. With a company of our size, with a partner network as big as we have, with as many community members as there are in this world, I see no good reason for questions of easy to medium difficulty to go without a reply.

So here are some ideas I’ve had to improve the unanswered posts problem:

Push to get additional Alfrescans involved in the forums, including departments other than Engineering.
Continue to encourage our top posters and points-earners to keep doing what they are doing.
Identify community members to become moderators. Task moderators with ownership of the unanswered post problem for the forums they moderate. This doesn’t mean they have to answer every question–but it does mean if they see a post that is going unanswered they should own finding someone who can.
Continue to refine and enhance forums reporting. I can post whatever forums metrics and measures would help you, the community, identify areas that need the most help or that motivate you to level up your forums involvement. Just let me know what those are.

What are your thoughts on these ideas? What am I missing? Please give me your ideas in the comments.

By the way, while I’m on the subject, I want to congratulate and thank the Top 10 Forum Users by Number of Posts for January of this year:

1.	mrogers*	74
2.	amandaluniz_z	36
3.	MikeH*	30
4.	jpotts*	25
5.	fuad_gafarov	22
6.	zomurn	21
7.	Andy*	19
8.	RodrigoA	16
9.	ddraper*	16
10.	mitpatoliya	16

As noted by the asterisk (*) half of January’s Top 10 are Alfresco employees.

And if you are looking for specific forums that need the most help in terms of unanswered posts, here are the Top 10 Forums by Current Unanswered Post Count (as of 2/16):

1.	Alfresco Share	210
2.	Configuration	169
3.	Alfresco Discussion	89
4.	Alfresco Share Development	85
5.	Installation	82
6.	Repository Services	54
7.	Workflow	47
8.	Development Environment	44
9.	Web Scripts	44
10.	Alfresco Explorer	40

I’ll post the February numbers next week, and will continue to do so each month if you find them helpful or inspiring.

February 27, 2012

Tip: Adding your own properties to a person object in Alfresco 3.4

Someone in our IRC channel recently asked how to add custom properties to the cm:person object and then configure Alfresco Share to show those properties in Alfresco 3.4.d Community. I have seen this come up in the forums as well and have done this before so I thought I’d do a quick write-up to show you how I did it.

As most people who try to do this are quick to discover, the user profile does not leverage the Alfresco form service to render its form. And rather than getting the person object metadata from a “normal” data web script like it does for other types of nodes, the data is read from a Share tier Java object called AlfrescoUser and AlfrescoUserFactory. Those classes only know how to deal with out-of-the-box properties of cm:person, so while you are free to add your own aspects to objects of type cm:person, the custom properties defined within those aspects won’t be available to the profile form without some additional work.

Although somewhat annoying when you come across the problem for the first time, it is remedied relatively easily by sub-classing the AlfrescoUserFactory class with your own and extending the client-side Alfresco.UserProfile object. Then it is just a matter of tweaking the userprofile web script to show your properties.

Assuming you have already created an aspect that defines the custom properties you want to add to the person object, the steps to make those usable from within the Share web client are:

Extend org.alfresco.web.site.SlingshotUserFactory with your own Factory class
In share-config-custom, override the defaults, user-factory element with a pointer to the new user factory bean
Override Alfresco’s profile.js with your own and extend the Alfresco.UserProfile component.
Extend org/alfresco/components/profile/userprofile.get.html.ftl with your own that references the extended user profile component and includes fields and labels for your custom properties.
Localize your custom properties.

I’ve whipped up a little example here. This example is known to work with Alfresco 3.4.d Community. You can use the same approach to implement this in other versions, but there have been some changes in this area across releases, so you probably will not be able to use the exact same code for different versions.

In my example, the fictitious company, SomeCo, wants to add the following fields to the person object:
– Birth Date (date field)
– Shirt Size (text field, constrained by a list)
– Significant Other (text field)
– Likes Neil Diamond (boolean for segregating employees into the two types of people in the world according to Bob Wiley: Those that like Neil Diamond and those that don’t).

Step 1. Extend org.alfresco.web.site.SlingshotUserFactory

In 3.4.d there are two methods you need to override: constructUser and saveUser. You can grab the source (it’s not in the source with the SDK or in Alfresco SVN–you’ll need the Spring Surf Web Scripts source) and have a look at that class and those methods to see if you can do the same for your version. If you are using 3.4.d Community you can just copy mine and modify it.

You’ll need to wire in the bean via Spring config. I put mine in custom-slingshot-application-context.xml.

Step 2. Point to the custom userfactory in Share config

Alfresco Share uses the form configuration to determine which user factory to use. So I override the default in share-config-custom.xml with a pointer to the bean declared in the previous step.

Step 3. Extend the client-side Alfresco.UserProfile component

Alfresco has a client-side JavaScript component called Alfresco.UserProfile that is used, among other things, to switch back-and-forth between read and edit mode. The onEditProfile method needs to know about my custom properties. So I created a new client-side component called SomeCo.UserProfile that extends Alfresco.UserProfile and replaces its onEditProfile method with my own. That client-side JavaScript lives in a file called “sc-profile.js”.

In order to get that client-side JavaScript file loaded, I must add a reference to the “userprofile” web script. So I copied userprofile.get.head.ftl from the OOTB location into the corresponding file path under web-extension, edited it, and added an “@script” entry for my script.

Step 4. Override the userprofile web script with new markup

Speaking of web scripts, that same userprofile web script builds the profile form, so I copied userprofile.get.html.ftl from the OOTB location into the corresponding location under web-extension and made a few changes. The first was to change out the reference to Alfresco.UserProfile to my custom profile, SomeCo.UserProfile. The profile data gets passed in as JSON so it must include the custom properties, so I added those. Then, I added markup used to display the custom properties in both read mode and edit mode.

Step 5. Localize the labels for the custom properties

The labels that display on the user profile form need to be localized. I created a somecoPeople.properties file under web-extension and then wired that in by overriding the webscripts.resources bean in custom-slingshot-application-context.xml.

That’s it. Once that’s done you can successfully set these properties by editing an existing profile.

Here is what it looks like when it is working:

You’ll note that I spent no time at all on the UI which is evident by requiring the user to enter the ISO8601 date time format (like 1976-07-04T00:00:00.000-05:00) instead of providing a nice calendar picker, not providing any sort of help text, and not doing any validation on any of the fields. It’s not that relevant to the topic (and I ran out of time).

Hope this helps. If you do the same thing for other Alfresco versions and can share what you did, please add a link in the comments. Maybe in future versions we’ll be able to do this through config.

February 20, 2012

Alfresco tutorial: Advanced Workflows using Activiti

In 2007, I wrote a tutorial on Alfresco’s advanced workflows which I later used as the basis for the workflow chapter in the Alfresco Developer Guide. It showed examples using jBPM and the old Alfresco Explorer web client.

Then, in April of 2011 I posted a short article comparing Alfresco workflows built with jBPM to the same workflows built with Activiti, the new advanced workflow engine embedded in Alfresco 4. The article provided a quick glimpse into the new Activiti engine aimed at those who had heard about the Alfresco-sponsored project.

Today I’m making available the 2nd edition of the advanced workflow tutorial. It combines the SomeCo whitepaper example from 2007 with a few hello world examples to show you how to use the Activiti Process Designer Eclipse plug-in and the Activiti engine to design and run the example workflows, including how to configure your workflows in the Alfresco Share web client.

The accompanying source code builds on the workflow model and associated customizations created in the 2nd editions of the custom content types and custom actions tutorials.

UPDATE 7/18/2013: Thanks to a user on #alfresco who reported a bug in the sample workflows that have a UI. None of those workflows could be started in Alfresco Community Edition 4.2.c. I have corrected the bug. So if you are using 4.2.c, please use this zip instead.

Special thanks go to Joram Barrez and Tijs Rademakers for reviewing the tutorial and providing valuable feedback. Both are on the Activiti team. In fact, Tijs has been working on an Activiti book called Activiti in Action which should be out soon, so keep an eye out for that.

Anyway, take a look and let me know what you think.

February 17, 2012

9 Things You Must Do to Have a Good Meetup

I spend a fair amount of time encouraging the formation of local community meetups around Alfresco and, when I can, attending many of these in all parts of the world. Alfresco meetups are especially fun because I get to meet people I’ve previously only known through the forums, IRC, or twitter.

I’ve started to identify characteristics of successful meetup groups. I thought I’d share them here and maybe others will add their ideas to the list.

Set an (interesting, relevant) agenda

Some meetups are staunchly anti-agenda. They exist because it is fun for people in the same or similar profession to get together to socialize. These have their place. For Alfresco meetups, however, I think it makes more sense to have a set agenda for each meeting. Sure, the agenda can have a “socializing” item on it, but I don’t think an Alfresco meetup that is based purely on socializing will last.

It’s also important that the agenda be interesting and relevant to your local community. I can’t tell you what that agenda is. You as a local community organizer should know. If you don’t, ask your attendees. Your attendees might be mostly technical. If so, you may have a code-filled agenda. Or, you might be completely non-technical so your agenda will be about end-user issues and solving business problems with Alfresco. I’ve been to some meetups that have a mix of both, so they start with a general interest topic and then split into technical and non-technical breakouts. The key is to know your group and what is going to work for them.

It shouldn’t be up to you to set the agenda for every meeting anyway. Make it a group effort. Or maybe rotate the responsibility.

Share responsibility

Speaking of that, find ways to get more people involved. A lot of these groups start out because one person is particularly passionate about a topic. That’s fine in the beginning, but look for ways to get others involved. It’s less work and it forms a stronger nucleus when others share the burden of the work that goes into consistently providing a quality meetup on a regular basis.

Provide food and drinks

It’s an easy win. A lot of times these meetings happen over lunch or dinner. Providing something to eat and drink helps people make the decision to come to your meetup when they are torn between their usual lunch spot and your meetup. Plus, pizza and beer are cheap crowd pleasers. Of course not everyone drinks beer so it’s a good idea to have something else on-hand, but you get the point.

In small groups, depending on the makeup, you might rotate refreshment duties. Or, try to get someone to sponsor your group and let them pick up the bill.

Foster connections

One of your roles as a community organizer is to act as a connector. You have a unique insight into each of your attendees’ motivation for attending the meetup so when you see two or more people that can help each other meet their goals make that introduction. The more connections you can make the more likely it is those people will return.

You might also consider setting up a channel for collaboration that can happen between meetings.

Publicize your meetup

Once you’ve set a time and a place for your meetup, you’ve got to get the word out. Many local Alfresco communities use meetup.com but there are alternatives. Regardless of where you host information about your meetup, make sure you are listed on the Local Communities wiki page.

If you are a partner and you are hosting or helping organize the meetup, contact your clients that are in the area and give them a personal invitation. You might even follow up on the day of the meetup to make sure they are coming.

If you let me know about your meetup I can help get the word out by inserting a blurb about it into Alfresco’s “Event Roundup” that goes out each month. I can also tweet about your meetup on my account and Alfresco’s.

I think sending out tweets a week prior, the day before, and the day of works pretty well.

Prohibit hard sales/recruiting pitches

If it turns out that your meetup is just an excuse to sell people your products or services, or people are descended upon by packs of rabid recruiters the minute they walk in the door, you’ll kill any chance you have of building something cool and long-term. No one wants to take time out of their personal schedule to hear a sales pitch. If you are a partner hosting the meetup, pay particular attention to this. People may walk in the door skeptical–you don’t want to confirm their fears with a hard sell.

I’m not saying you shouldn’t mention who donated the space or who paid for the sandwiches. If you want to keep getting free space and sandwiches you’ve got to do that. Just be cool about it. I think giving a sponsor two minutes to talk about what they do while everyone is grabbing a drink is reasonable.

As the meetup organizer it is your job to work with the rest of the group to establish ground rules about acceptable behavior and to swiftly (but professionally) deal with people who act outside the norms of your group.

Pick a central location

I live in Dallas, which isn’t just a city, it’s a “Metroplex”, which, roughly translated means, “No matter where you decide to have your meetup, someone’s going to drive an hour or more to get there.” That can make picking a meetup spot tough.

Especially when you are starting out, look at who’s coming and where they are coming from and try to pick a central location. You can try a different location for each meeting, but I’ve found that you will end up just getting a different set of attendees each time based on where the meeting is. There’s no easy answer. The best advice is to pick a central location, near main arteries and mass transit, make sure your start time comprehends traffic patterns at that time of the day, and make your agenda compelling enough that someone will want to make the journey.

Welcome everyone

It is important that everyone feel welcome at our meetups. This idea of inclusiveness is comprehensive. It covers everything from your relationship with Alfresco (Enterprise customer, Community user, partner, employee) to your demography (age, race, religion, sex, orientation). Everyone shares in the responsibility of fostering a welcoming atmosphere and raising the issue with the group its leaders if something is out-of-line.

Have fun!

Last, your meetup has got to be fun. We all sit in mind-numbing meetings as part of our day job. Why would we want to spend personal time in yet another one? Part of this is about encouraging interactivity. Don’t just have presentation after presentation. Ask the attendees to share short stories about their projects or implementations. Maybe set a common goal to develop an add-on for the community and challenge another local community to do the same.

If you are organizing local community groups around Alfresco and you haven’t yet introduced yourself to me, please do so. I can also hook you into our community of community organizers, which we call Team LoCo (I stole the name from Jono Bacon). And, if you have additional thoughts on what makes a great meetup, please share them in the comments.

January 30, 2012

Tech Talk Live Lives: Join us on the 1st Wednesday of each month

They say good habits are like fine crystal: Hard to make and easily broken. We resurrected the Tech Talk Live series a few times last year and then DevCon rolled around and obliterated any hope of continuing the monthly webinar in the last quarter of 2011.

So after a brief hiatus, it is time to get it going again. We do these on the first Wednesday of each month and that means this Wednesday is the day. Our topic will be “Packaging and Deployment Best Practices” and with the panel we’ve put together it should be lively and entertaining. Joining me will be Richard McKnight, Gabriele Columbro, Jared Ottley, and Richard Esplin. We’ll be talking about the new Add-Ons directory, AMPs, Maven, and all sorts of good stuff around packaging and deploying extensions for Alfresco.