Alfresco Share 5.2图片URL含undefinedcomponents致500错误求助

问题现象 #

• 前端JavaScript控制台报错：加载Lightbox资源时URL包含undefinedcomponents，返回500内部服务器错误

  loading.gif:1 
  GET https://dummyURL.net/share/page/undefinedcomponents/images/lightbox/loading.gif 500 (Internal Server Error)
  e       
  a   @   lightbox_bc0f7ca3f12…2ad82dace7cae3.js:1
  load        
  (anonymous) @   lightbox_bc0f7ca3f12…2ad82dace7cae3.js:1
  (anonymous) @   lightbox_bc0f7ca3f12…2ad82dace7cae3.js:1
  

• 内容安全策略（CSP）相关错误：

  Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-sbLba2EWG/CqNqV0hSLOf+VTwjgqU+JUKEszzaqWntU='), or a nonce ('nonce-...') is required to enable inline execution.
  

  dojo.js:15 Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
  
      at new Function (<anonymous>)
      at dojo.js:15:3521
      at dojo.js:15:21290
  

• 后端Catalina.out错误堆栈：

  SEVERE: Servlet.service() for servlet [Spring Surf Dispatcher Servlet] in context with path [/share] threw exception [Could not resolve view with name 'undefinedcomponents/images/lightbox/close.gif' in servlet with name 'Spring Surf Dispatcher Servlet'] with root cause
  javax.servlet.ServletException: Could not resolve view with name 'undefinedcomponents/images/lightbox/close.gif' in servlet with name 'Spring Surf Dispatcher Servlet'
      at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1198)
      at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1001)
      at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:945)
      at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:867)
      at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:951)
      at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:842)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
      at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:827)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at com.atolcd.alfresco.AuditFilter.doFilter(AuditFilter.java:200)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.springframework.extensions.webscripts.servlet.SecurityHeadersFilter.doFilter(SecurityHeadersFilter.java:177)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.springframework.extensions.webscripts.servlet.CSRFFilter.doFilter(CSRFFilter.java:322)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.alfresco.web.site.servlet.SSOAuthenticationFilter.doFilter(SSOAuthenticationFilter.java:474)
      at org.alfresco.web.site.servlet.SSOAuthenticationFilter.doFilter(SSOAuthenticationFilter.java:443)
      at org.springframework.extensions.webscripts.servlet.BeanProxyFilter.doFilter(BeanProxyFilter.java:80)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.alfresco.web.site.servlet.MTAuthenticationFilter.doFilter(MTAuthenticationFilter.java:81)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
      at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
      at org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:188)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
      at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2549)
      at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2538)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Thread.java:748)
  

• 已尝试操作：恢复数据库/ContentStore、重装Share WAR，问题未解决

排查解决思路 #

1. 定位undefinedcomponents来源 #

• 检查Lightbox组件的模板与Web脚本：查看share/WEB-INF/classes/alfresco/site-webscripts/org/alfresco/components/lightbox下的FTL模板和JS脚本，确认资源路径拼接逻辑是否存在未初始化的变量，导致undefined被插入到URL中。
• 排查第三方插件影响：从错误堆栈可见系统安装了Atolcd Audit插件，尝试临时禁用该插件（移除相关JAR或修改配置），验证问题是否消失，排查插件是否修改了Lightbox组件的资源引用路径。
• 清理客户端与服务器缓存：强制刷新浏览器缓存（Ctrl+Shift+R），同时清理Tomcat的work目录，重启服务后验证是否为缓存导致的旧代码执行问题。

2. 解决CSP相关错误 #

• 调整Content Security Policy配置：在share-config-custom.xml中修改Security Headers Filter的CSP规则，添加必要的unsafe-inline和unsafe-eval（注意安全风险，也可使用哈希或nonce替代），示例配置：

  <config evaluator="string-compare" condition="SecurityHeaders">
    <headers>
      <header name="Content-Security-Policy" value="script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" />
    </headers>
  </config>
  

• 适配Dojo运行需求：Alfresco 5.2依赖的Dojo框架部分功能需要unsafe-eval支持，确保CSP规则允许该来源，或评估升级Dojo版本以减少对unsafe-eval的依赖。

3. 其他排查方向 #

• 验证Spring Surf视图解析配置：检查share/WEB-INF/spring-surf-views-config.xml中的视图解析器配置，确保能正确解析组件资源路径。
• 检查文件系统权限：确认Share WAR解压后的components/images/lightbox目录及文件存在，且Tomcat进程拥有读取权限。
• 查看完整日志：除Catalina.out外，检查alfresco.log和share.log，寻找组件初始化失败、资源加载异常等上下文日志信息。

内容的提问来源于stack exchange，提问作者Vipul Swarup