You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lucene.apache.org by Tom Burton-West <tb...@umich.edu> on 2014/04/09 19:13:51 UTC
Solr 4.7 example solrconfig.xml has confusing comments about a
security vulnerability
In /SOLR-5522 the handler configuration code for the admin/fileedit
request handler which would o allow modification of Solr Config files was
removed from the example solrconfig.xml, but the comments were left in the
example file.
http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_4_7/solr/example/solr/collection1/conf/solrconfig.xml?r1=1547261&r2=1547270
Thus the warning (appended below) was left in the example solrconfig.xml.
I spent a bit of time trying to figure out how the ping/healthcheck
request handler would allow the Solr UI to edit config files before I
figured out that the comment applied to a request handler that had been
removed from the example file.
Should I open a JIRA issue and provide a patch?
Tom
<!--
Enabling this request handler (which is NOT a default part of the admin
handler) will allow the Solr UI to edit
all the config files. This is intended for secure/development use ONLY!
Leaving available and publically
accessible is a security vulnerability and should be done with extreme
caution!
-->
<!-- ping/healthcheck -->
<requestHandler name="/admin/ping" class="solr.PingRequestHandler">
<lst name="invariants">
Re: Solr 4.7 example solrconfig.xml has confusing comments about a
security vulnerability
Posted by Erick Erickson <er...@gmail.com>.
Thanks for catching that!
On Wed, Apr 9, 2014 at 10:50 AM, Tom Burton-West <tb...@umich.edu> wrote:
> Hi Shawn,
>
> OK, will do. (but later today, since I have to eat lunch and then go to a
> meeting).
>
> Tom
>
>
> On Wed, Apr 9, 2014 at 1:19 PM, Shawn Heisey <so...@elyograg.org> wrote:
>>
>> On 4/9/2014 11:13 AM, Tom Burton-West wrote:
>>>
>>> In /SOLR-5522 the handler configuration code for the admin/fileedit
>>> request handler which would o allow modification of Solr Config files was
>>> removed from the example solrconfig.xml, but the comments were left in the
>>> example file.
>>>
>>>
>>> http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_4_7/solr/example/solr/collection1/conf/solrconfig.xml?r1=1547261&r2=1547270
>>>
>>> Thus the warning (appended below) was left in the example
>>> solrconfig.xml. I spent a bit of time trying to figure out how the
>>> ping/healthcheck request handler would allow the Solr UI to edit config
>>> files before I figured out that the comment applied to a request handler
>>> that had been removed from the example file.
>>>
>>> Should I open a JIRA issue and provide a patch?
>>
>>
>> Definitely. If there's a respin on the 4.7.2 release, I'll try to get it
>> in there.
>>
>> Thanks,
>> Shawn
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
>> For additional commands, e-mail: dev-help@lucene.apache.org
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org
Re: Solr 4.7 example solrconfig.xml has confusing comments about a
security vulnerability
Posted by Tom Burton-West <tb...@umich.edu>.
Hi Shawn,
OK, will do. (but later today, since I have to eat lunch and then go to a
meeting).
Tom
On Wed, Apr 9, 2014 at 1:19 PM, Shawn Heisey <so...@elyograg.org> wrote:
> On 4/9/2014 11:13 AM, Tom Burton-West wrote:
>
>> In /SOLR-5522 the handler configuration code for the admin/fileedit
>> request handler which would o allow modification of Solr Config files was
>> removed from the example solrconfig.xml, but the comments were left in the
>> example file.
>>
>> http://svn.apache.org/viewvc/lucene/dev/branches/lucene_
>> solr_4_7/solr/example/solr/collection1/conf/solrconfig.
>> xml?r1=1547261&r2=1547270
>>
>> Thus the warning (appended below) was left in the example
>> solrconfig.xml. I spent a bit of time trying to figure out how the
>> ping/healthcheck request handler would allow the Solr UI to edit config
>> files before I figured out that the comment applied to a request handler
>> that had been removed from the example file.
>>
>> Should I open a JIRA issue and provide a patch?
>>
>
> Definitely. If there's a respin on the 4.7.2 release, I'll try to get it
> in there.
>
> Thanks,
> Shawn
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
> For additional commands, e-mail: dev-help@lucene.apache.org
>
>
Re: Solr 4.7 example solrconfig.xml has confusing comments about
a security vulnerability
Posted by Shawn Heisey <so...@elyograg.org>.
On 4/9/2014 11:13 AM, Tom Burton-West wrote:
> In /SOLR-5522 the handler configuration code for the admin/fileedit
> request handler which would o allow modification of Solr Config files
> was removed from the example solrconfig.xml, but the comments were
> left in the example file.
>
> http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_4_7/solr/example/solr/collection1/conf/solrconfig.xml?r1=1547261&r2=1547270
>
> Thus the warning (appended below) was left in the example
> solrconfig.xml. I spent a bit of time trying to figure out how the
> ping/healthcheck request handler would allow the Solr UI to edit
> config files before I figured out that the comment applied to a
> request handler that had been removed from the example file.
>
> Should I open a JIRA issue and provide a patch?
Definitely. If there's a respin on the 4.7.2 release, I'll try to get
it in there.
Thanks,
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org