Security

Hi

I need to implement some Security Features in my Portal . below are the list of issues that were identified .
Please point me to the correct documentation or Steps that I need in order to implement the security measures.

1) I observed that AutoComplete was enabled in potentially sensitive form fields. - Disable AutoComplete .

Hi,

I am trying to set the pool level auto-login feature for a bonita form . I have created the username and password for the anonymous user(at pool level) and created a URL in the format of : (Note:Project Initiation is the pool name and 1.4.0 is the bos version and process = process Id ).

I need to handle data that is restricted according to different actors.

Can I define in someway that data so it is handled differently whether is one actor or another.

And also how is data secured in terms of attackers trying to steal data with attacks like men in the middle or any other types of attacks.

Can data be encrypted in the database used by Bonita or when transmitted to an external database?

Thanks.

Hi there,

BAR flies are compiled code of a process which allows them to be implemented in QA/Integration and Production setting and stops them being looked at by the unnecessary.

However I've just read in Build a process for deployment (point 4) that is is possible to simply reverse engineer a implemented BAR into a BOS and hence into studio (when using a SP version of Bonita).

I just started evaluating Bonitasoft. When I run the "Travel Request" example from BPM Studio I noticed that it opens the browser with the username and password in the URL. This looks like a big security hole. Is there an alternative configuration?

Colegas,

Tengo el siguiente problema, pretendo cargar un formulario de bonita a través de un iframe dentro de un HTML, pero al momento de invocarlo no lo carga, ya revise mi archivo web.xml según la nota:

http://community.bonitasoft.com/answers/embed-bonita-page-iframe-0

Sin embargo al momento de comentar la linea

Hello,

I am new to Bonita (as of today :)).

Just tried a simple Web service and it works fine with unsecured web service and Basic Authentication, but our production web services require WS-Security with Username Token.

Thanks,

Boris