Error "There was a problem retreiving the available authorities" after installing 2.37.5 hotfix

[swoodworth (Simon Woodworth)]

Hi all,

Last night I installed the 2.37.5 hotfix to remove the Spring4Shell vulnerability. Everything seems fine but when I go to click on a specific User Role, the authorities are no longer listed. Instead I get “There was a problem retreiving the available authorities”

In catalina.out I get the error message below.

How do I fix this?

Thanks!
Simon.

Click here to see Catalina.out log

• ERROR 2022-04-07T17:57:46,901 Exception occurred during processing request: Unable to instantiate Action, org.hisp.dhis.commons.action.GetSystemAuthoritiesAction, defined for ‘getSystemAuthorities’ in namespace '/dhis-web-commons/security’Error creating bean with name ‘org.hisp.dhis.commons.action.GetSystemAuthoritiesAction’ defined in URL [jar:file:/home/dhis/tomcat-dhis/webapps/ROOT/WEB-INF/lib/dhis-web-commons-2.37.5.jar!/META-INF/dhis/beans.xml]: Cannot resolve reference to bean ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ while setting bean property ‘authoritiesProvider’; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ available (DefaultDispatcherErrorHandler.java [http-nio-8080-exec-1])
  com.opensymphony.xwork2.XWorkException: Unable to instantiate Action, org.hisp.dhis.commons.action.GetSystemAuthoritiesAction, defined for ‘getSystemAuthorities’ in namespace '/dhis-web-commons/security’Error creating bean with name ‘org.hisp.dhis.commons.action.GetSystemAuthoritiesAction’ defined in URL [jar:file:/home/dhis/tomcat-dhis/webapps/ROOT/WEB-INF/lib/dhis-web-commons-2.37.5.jar!/META-INF/dhis/beans.xml]: Cannot resolve reference to bean ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ while setting bean property ‘authoritiesProvider’; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ available
  at com.opensymphony.xwork2.DefaultActionInvocation.createAction(DefaultActionInvocation.java:320) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.DefaultActionInvocation.init(DefaultActionInvocation.java:401) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.DefaultActionProxy.prepare(DefaultActionProxy.java:201) ~[struts2-core-2.5.26.jar:2.5.26]
  at org.apache.struts2.factory.StrutsActionProxy.prepare(StrutsActionProxy.java:57) ~[struts2-core-2.5.26.jar:2.5.26]
  at org.apache.struts2.factory.StrutsActionProxyFactory.createActionProxy(StrutsActionProxyFactory.java:32) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.DefaultActionProxyFactory.createActionProxy(DefaultActionProxyFactory.java:60) ~[struts2-core-2.5.26.jar:2.5.26]
  at org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:564) [struts2-core-2.5.26.jar:2.5.26]
  at org.apache.struts2.dispatcher.ExecuteOperations.executeAction(ExecuteOperations.java:79) [struts2-core-2.5.26.jar:2.5.26]
  at org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:141) [struts2-core-2.5.26.jar:2.5.26]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.hisp.dhis.commons.jsonfiltering.web.JsonFilteringRequestFilter.doFilter(JsonFilteringRequestFilter.java:71) [dhis-support-json-filtering-2.37.5.jar:?]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.hisp.dhis.servlet.filter.AppOverrideFilter.doFilterInternal(AppOverrideFilter.java:175) [dhis-web-commons-2.37.5.jar:?]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.hisp.dhis.webapi.filter.RequestIdentifierFilter.doFilterInternal(RequestIdentifierFilter.java:105) [dhis-web-api-2.37.5.jar:?]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) [tomcat9-websocket-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.hisp.dhis.servlet.filter.HttpUrlPatternFilter.doFilter(HttpUrlPatternFilter.java:123) [dhis-web-commons-2.37.5.jar:?]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:327) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:105) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.hisp.dhis.webapi.filter.CorsFilter.doFilter(CorsFilter.java:116) [dhis-web-api-2.37.5.jar:?]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:218) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.hisp.dhis.webapi.filter.CustomAuthenticationFilter.doFilter(CustomAuthenticationFilter.java:90) [dhis-web-api-2.37.5.jar:?]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) [spring-security-web-5.4.7.jar:5.4.7]
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.springframework.orm.hibernate5.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:156) [spring-orm-5.3.18.jar:5.3.18]
  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) [spring-web-5.3.18.jar:5.3.18]
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:688) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat9-catalina-9.0.31.jar:9.0.31]
  at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:375) [tomcat9-coyote-9.0.31.jar:9.0.31]
  at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat9-coyote-9.0.31.jar:9.0.31]
  at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat9-coyote-9.0.31.jar:9.0.31]
  at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1639) [tomcat9-coyote-9.0.31.jar:9.0.31]
  at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat9-coyote-9.0.31.jar:9.0.31]
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
  at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat9-util-9.0.31.jar:9.0.31]
  at java.lang.Thread.run(Thread.java:829) [?:?]
  Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name ‘org.hisp.dhis.commons.action.GetSystemAuthoritiesAction’ defined in URL [jar:file:/home/dhis/tomcat-dhis/webapps/ROOT/WEB-INF/lib/dhis-web-commons-2.37.5.jar!/META-INF/dhis/beans.xml]: Cannot resolve reference to bean ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ while setting bean property ‘authoritiesProvider’; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ available
  at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:342) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:113) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1707) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1452) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:619) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:353) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1154) ~[spring-context-5.3.18.jar:5.3.18]
  at com.opensymphony.xwork2.spring.SpringObjectFactory.buildBean(SpringObjectFactory.java:166) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.ObjectFactory.buildBean(ObjectFactory.java:177) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.factory.DefaultActionFactory.buildAction(DefaultActionFactory.java:40) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.ObjectFactory.buildAction(ObjectFactory.java:142) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.DefaultActionInvocation.createAction(DefaultActionInvocation.java:301) ~[struts2-core-2.5.26.jar:2.5.26]
  … 104 more
  Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named ‘org.hisp.dhis.security.SystemAuthoritiesProvider’ available
  at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:872) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1344) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:309) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:330) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:113) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1707) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1452) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:619) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:353) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) ~[spring-beans-5.3.18.jar:5.3.18]
  at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1154) ~[spring-context-5.3.18.jar:5.3.18]
  at com.opensymphony.xwork2.spring.SpringObjectFactory.buildBean(SpringObjectFactory.java:166) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.ObjectFactory.buildBean(ObjectFactory.java:177) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.factory.DefaultActionFactory.buildAction(DefaultActionFactory.java:40) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.ObjectFactory.buildAction(ObjectFactory.java:142) ~[struts2-core-2.5.26.jar:2.5.26]
  at com.opensymphony.xwork2.DefaultActionInvocation.createAction(DefaultActionInvocation.java:301) ~[struts2-core-2.5.26.jar:2.5.26]
  … 104 more

[swoodworth (Simon Woodworth)]

Any chance of someone picking this up?

[Gassim (AL-Gassim Sharaf Addin)]

@swoodworth , Thanks! I’m actually following up on this with the developers. Thanks!

@swoodworth , thank you for your patience! So actually there was an issue with the upgrade and it has been fixed. There will be a release soon, and I will make sure to let you know when it’s available. (You’ll also see it in the Announcements - Annonces category.) Thanks!

[swoodworth (Simon Woodworth)]

@Gassim this is fantastic thanks!

[stephocay (Stephen Ocaya)]

Great, I am also looking forward to the fix. How do we get a build so we are able to update accordingly and continue with current configurations?

[Gassim (AL-Gassim Sharaf Addin)]

@swoodworth, pleasure!

@stephocay

How do we get a build so we are able to update accordingly and continue with current configurations?

@stephocay , you’ll get all the necessary information in a post such as this one:

DHIS2 patch release 2.37.5 is now available - [SECURITY HOTFIX]

Dear all, DHIS2 version 2.37.5 (patch release) is out as a HOTFIX for the vulnerability referred to as “spring4shell”. This is the latest stable release for version 2.37, and supersedes releases 2.37.0 to 2.37.4. The release note for this patch can be found here: Patch 2.37.5 Release Note. Thanks! DHIS2 Release Team Release Information Links Release Note Patch 2.37.5 Release Note Upgrade notes 2.37 Upgrade notes Download release and sample database Downloads - DHIS2 Documenta…

[phil (Philip Larsen Donnelly)]

@swoodworth @stephocay

The patch is now available: released as a hotfix for just this issue in order to resolve it quickly.

DHIS2 patch release 2.37.6 is now available - [HOTFIX]

Dear all, DHIS2 version 2.37.6 (patch release) is out as a HOTFIX for an issue that was unfortunately introduced with the most recent hotfix, which addressed the “spring4shell” issue by increasing the version of the Spring library. Many thanks to @swoodworth for flagging this issue, which made it impossible to assign authorities to user roles. As a hotfix, this addresses only the issue referred to above. Nevertheless, this is the latest stable release for version 2.37, and supersedes releases …

Sorry about the delay with this. Unfortunately the release team didn’t see Simon’s post for several days.

[Gassim (AL-Gassim Sharaf Addin)]

Thanks @Phil and release team! (:

@swoodworth thanks a lot for your post! Please feel free to post back with the result from your side! Thanks!

[swoodworth (Simon Woodworth)]

Many thanks @Gassim and @phil. Going to apply this patch tonight!

[Gassim (AL-Gassim Sharaf Addin)]

Good luck @swoodworth !

[swoodworth (Simon Woodworth)]

@phil @Gassim just applied the patch and all is working perfectly. Authorities correctly displayed when creating / editing a role. Thanks!

[moses_mwale]

Hello all,
Sorry to report bugs under this but it looks like the problem is back in 2.37.7 @Gassim .

Cannot resolve reference to bean 'org.hisp.dhis.security.SystemAuthoritiesProvider' while setting bean property 'authoritiesProvider'; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'org.hisp.dhis.security.SystemAuthoritiesProvider' available

I came across it when trying to create roles or anything under users.

I may need to downgrade in the meantime.

thanks.
-Moses

[mutali (Jean Paul Mutali)]

Yes its reproducible on demo sever @Gassim

[Amza (Amza Nd)]

Dear Team, the error is still there on version 2.37.5 and 2.37.7
@Phil @release team please we are waiting for the fix

warm regards

[phil (Philip Larsen Donnelly)]

Hi @Amza

Thanks for flagging this! We will look into it and get back to you.

In the meantime, 2.37.6.1 should work without the error.

Kind regards,
Phil

[Amza (Amza Nd)]

Dear Phil, thank you for your support. This version is working well with user role creation.

Warm regards

Amza

[phil (Philip Larsen Donnelly)]

Dear all,

hotfix 2.37.7.1 is now available as a direct replacement to 2.37.7 to fix this issue:

DHIS2 release 2.37.7.1 is now available - HOTFIX

Dear all, DHIS2 version 2.37.7.1 is out as a HOTFIX release to address a blocking user authorities issue [DHIS2-13465]. This patch also contains a minor security update to the Struts library. This is the latest stable release for version 2.37, and supersedes releases 2.37.0 to 2.37.7. As a “hotfix” this can be considered a direct replacement to 2.37.7. The release note for this patch can be found here: Patch 2.37.7.1 Release Note. Thanks! DHIS2 Release Team Release Information Links …

Kind regards,
Phil

[mohammadayub864 (Mohammad Ayub Yousafzai)]

Dear moses mwale,

I have the same problem , please use the latest version 2.38 it is going to be solved.

Regards
Mohammad Ayub Yousafzai