Escalate any user rights to admin in Adobe Campaign Classic
In Adobe Campaign Classic, web forms allow anonymous access by default, while their server-side operations use the permissions of the WebApp operator. Some operations require permissions this operator does not have. Giving it full administrator access just to perform a specific task would grant broader access than necessary.
Where privilege escalation is permitted, you can use logonEscalation() to temporarily switch the script’s execution context to another operator. After completing the operation, you restore the previous context with logonWithContext(). This changes which operator the code runs as; it does not permanently change the original operator’s permissions.
I first discovered logonEscalation() while browsing the AEM integration package, where it was used in JSSP pages. I then found that the same function also worked in web applications and, to my surprise, inside a workflow’s JavaScript activity.
//escalate right to user
var logonEscalationCtx = logonEscalation("admin");
//do you admin stuff with current user
//return back to your actual user
logonWithContext(logonEscalationCtx);Choose an operator with only the permissions the task requires, and keep the elevated section of code as small as possible. Restore the previous context in a finally block so that restoration is attempted even if the operation throws an error. Availability also depends on your instance’s security configuration: Adobe documents cases where privilege escalation is forbidden.
This means our logon escalation function depends on the instance’s security configuration. If XtkSecurity_Allow_PrivilegeEscalation is disabled, the escalation may be rejected with a “Privilege escalation forbidden” error.
