You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "mridulpathak (via GitHub)" <gi...@apache.org> on 2026/08/17 15:00:59 UTC
[PR] Improved: Add validation and permission check to replaceImageToExistImage service [ofbiz-framework]
mridulpathak opened a new pull request, #1671:
URL: https://github.com/apache/ofbiz-framework/pull/1671
The service only required authentication and performed no permission or file-path validation before reading and writing image files, allowing a user without image management access to reach the file-write logic and for input to resolve outside the intended product image directory. Added a CATALOG_UPDATE permission check and reused the existing file-name/path containment validation from ImageManagementServices.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved: Add validation and permission check to replaceImageToExistImage service [ofbiz-framework]
Posted by "mridulpathak (via GitHub)" <gi...@apache.org>.
mridulpathak merged PR #1671:
URL: https://github.com/apache/ofbiz-framework/pull/1671
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved: Add validation and permission check to replaceImageToExistImage service [ofbiz-framework]
Posted by "jacopoc (via GitHub) via notifications" <no...@ofbiz.apache.org>.
jacopoc commented on PR #1671:
URL: https://github.com/apache/ofbiz-framework/pull/1671#issuecomment-6637264194
CVE-2026-76150
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org