Launching command line script from OneClick custom menu item runs indefinitely

Document ID : KB000015259
Last Modified Date : 14/02/2018
Show Technical Document Details
Question:

We are attempting to create a custom menu pick in OneClick, which uses the launch-web-server-script. We've created a simple test script to princh/echo the string "Hello, World" to a text file. However when we select the customized menu pick from our OneClick client, the status dialog window appears, but the progress bar just sit there and runs indefinitely, without completion or failure. Why?

Answer:

What you are seeing is functioning as designed (FAD), and requires a restart of Tomcat. 

 

There was a security change in Spectrum 9.4 that requires a restart of tomcat before we will execute a Web server script from a menu pick. This change was brought about due to a vulnerability risk, where a malicious request could be constructed with a harmful command, such as “shutdown”, which could be sent to the OneClick Web Server and executed.

 

To protect against this vulnerability, engineering modified OneClick so that the processes names are loaded from the “custom-menu-config.xml” when tomcat starts up. Therefore, each invocation of a custom menu will send a command/process name to tomcat, which needs to be validated, by reviewing a white list of allowable processes, created when we start Tomcat.

Additional Information:

For more information regarding creating custom menus in OneClick see the "OneClick Customization" guide, located at https://docops.ca.com/ca-spectrum/10-2-1/en/customizing/oneclick-customization.