Aller au contenu principal
Jahia Store
FR

Page Builder Background Jobs

community
Télécharger 1.0.1

Informations

Identifiant du module
pagebuilder-background-jobs
Identifiant de groupe
org.jahia.community
Statut
community
Catégorie
Admin Features
Auteur
dgigon@jahia.com
Site web du développeur
http://www.jahia.com
Nécessite Jahia
8.2.2.0
Mis à jour
2026-08-17
Source
scm:git:git@github.com:Jahia/pagebuilder-background-jobs.git
Étiquettes
  • pagebuilder
  • publication jobs

Page Builder Background Jobs

Overview

Page Builder Background Jobs adds a jobs panel to the JContent Page Builder header. It allows authorized users to monitor publication-related background jobs directly from Page Builder, without leaving the current editing context.

Depending on its OSGi configuration, the module can either display only publication jobs or expose the full list of background jobs.

Main Features

  • Adds a dedicated action in the JContent Page Builder header.
  • Displays background job information in a dedicated dialog.
  • Supports auto-refresh and pagination.
  • Can be configured to show only publication jobs or all background jobs.
  • Can be restricted to authorized users through Jahia permissions.

User Interface Modes

The module supports two display modes.

Publication jobs mode

  • Default mode.
  • Only jobs whose group contains PublicationJob are returned.
  • The header button label is Publication jobs.

Background jobs mode

  • Optional full mode.
  • All background jobs are returned.
  • The header button label is Background jobs.
  • Job group filters are displayed in the dialog.

OSGi Configuration

The module behavior is controlled through the following OSGi configuration:

PID: org.jahia.support.modules.pagebuilder.backgroundjobs

Property: showAllJobs

Default value:

showAllJobs=false

Behavior:

  • showAllJobs=false: only publication jobs are displayed.
  • showAllJobs=true: all background jobs are displayed.

Permissions

The module provides a dedicated Jahia permission:

canAccessJobsInformation

Access is granted under the following rules:

  • guest users are denied.
  • root is allowed.
  • Users with the Jahia admin permission are allowed.
  • Users with canAccessJobsInformation are allowed.

If a user does not have access, the action button is hidden in the Page Builder interface.

Displayed Information

The dialog can display the following information for each job:

  • Job name
  • Job group or type
  • Status
  • Description
  • Creation time
  • Duration
  • User

In full mode, the dialog also provides job group filters to help users narrow down the list.

Captures d'écran

Versions

⚠️ Security — upgrade from 1.0.0 is recommended

1.0.1 closes a security issue. A principal granted canAccessJobsInformation on one site could read every site's publication-job metadata, including which user (userKey) triggered each publication.

Four bypasses were found and closed — three of them introduced by the fix for the previous one:

  1. Requesting another site's key — the answer was argument-independent.
  2. Omitting siteKey entirely — the first fix filtered on that argument, so leaving it out skipped the filter.
  3. Disagreeing siteKey and path — the permission was checked against one and the result scoped to the other.
  4. A .. traversal path — JCR normalizes .. before resolving, so string parsing and the permission check diverged.

Authorization now resolves to denied / unrestricted / scoped to the sites the caller actually holds the permission on, and results are filtered against that. Caller-supplied arguments never widen the result. 

Also in this release

The module was previously unusable by anyone but root. It shipped no API authorization scope for its GraphQL fields, so Jahia's security filter refused them to every non-root caller before the resolver ran — meaning canAccessJobsInformation could never take effect. 1.0.1 ships org.jahia.bundles.api.authorization-pagebuilder-background-jobs.yml.

Two roles now ship (src/main/import/roles.xml): background-jobs-viewer (site-scoped) and background-jobs-administrator (server-wide). Previously the module shipped the permission with no role carrying it, so it was inert on a fresh install. Grant one of these after upgrading.

Site attribution now works on modern Jahia. Jahia does not populate sitekey for publications triggered via jContent/GraphQL, which left site-scoped users with an empty dialog. The site is now extrapolated from publicationPaths; multi-site jobs are visible only to callers authorized on every site they touch.

Other fixes

  • The shipped .cfg gained the mandatory # default configuration - won't be overridden line — without it Jahia rewrote the deployed copy on every start, discarding showAllJobs=true.
  • Denials return a proper GraphQL client error instead of "Internal Server Error(s) while executing query".
  • Dates use the viewer's locale instead of a hardcoded fr-FR.
  • Accessibility: aria-expanded/aria-controls on the status groups, and link contrast raised from 4.6:1 to 7.4:1 (AAA).
  • A supplied siteKey/path that resolves to no site is denied rather than silently ignored.
Nécessite Jahia 8.2.2.0Mis à jour 2026-08-17
Nécessite Jahia 8.2.2.0Mis à jour 2026-03-12