You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2016/06/19 22:30:58 UTC
svn commit: r1749221 - in /ofbiz/branches/release15.12: ./ .classpath
LICENSE build.xml framework/base/lib/shiro-core-1.2.3.jar
framework/base/lib/shiro-core-1.2.5.jar
Author: jleroux
Date: Sun Jun 19 22:30:58 2016
New Revision: 1749221
URL: http://svn.apache.org/viewvc?rev=1749221&view=rev
Log:
"Applied fix from trunk for revision: 1749220 "
------------------------------------------------------------------------
r1749220 | jleroux | 2016-06-20 00:30:06 +0200 (lun. 20 juin 2016) | 5 lignes
Updates Shiro to 1.2.5 (CVE-2016-4437) - https://issues.apache.org/jira/browse/OFBIZ-7373
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Details at https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4437
------------------------------------------------------------------------
Added:
ofbiz/branches/release15.12/framework/base/lib/shiro-core-1.2.5.jar
- copied unchanged from r1749220, ofbiz/trunk/framework/base/lib/shiro-core-1.2.5.jar
Removed:
ofbiz/branches/release15.12/framework/base/lib/shiro-core-1.2.3.jar
Modified:
ofbiz/branches/release15.12/ (props changed)
ofbiz/branches/release15.12/.classpath
ofbiz/branches/release15.12/LICENSE
ofbiz/branches/release15.12/build.xml
Propchange: ofbiz/branches/release15.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sun Jun 19 22:30:58 2016
@@ -9,4 +9,4 @@
/ofbiz/branches/json-integration-refactoring:1634077-1635900
/ofbiz/branches/multitenant20100310:921280-927264
/ofbiz/branches/release13.07:1547657
-/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1727894,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735021,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1736890,1737156,1737440,1738235,1738303,1738407,1738902,1739438,1739448,1739571,1740008,1740442,1740629,1741146,1741563,1741684,1741925,1741930,1741960,1742018,1742097,1742103,1742712,1742737,1742741,1743025,1743027,1743230,1743411-1743412,1743656,1743937,1744117,1744198,1744396,1744662,1744768,1744773,1744873,1744911,1745111,1745264,1745428,1745438,1745573,1745577,1745592,1745751,1746228,
1746422,1746459,1746524,1746527,1746536,1746601,1746676,1746714,1746755,1746805,1746832,1746890,1747223,1747349,1747498,1747639,1747642,1747646,1747650,1747661,1747956,1747959,1747963,1748121,1748133,1748206,1748218,1748223,1748260,1748357,1748394,1748401,1748543,1748559,1748628,1748689,1748693,1748703,1748837,1748854,1748907,1748925,1748929,1748944,1748972,1749026,1749083,1749092,1749111
+/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1727894,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735021,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1736890,1737156,1737440,1738235,1738303,1738407,1738902,1739438,1739448,1739571,1740008,1740442,1740629,1741146,1741563,1741684,1741925,1741930,1741960,1742018,1742097,1742103,1742712,1742737,1742741,1743025,1743027,1743230,1743411-1743412,1743656,1743937,1744117,1744198,1744396,1744662,1744768,1744773,1744873,1744911,1745111,1745264,1745428,1745438,1745573,1745577,1745592,1745751,1746228,
1746422,1746459,1746524,1746527,1746536,1746601,1746676,1746714,1746755,1746805,1746832,1746890,1747223,1747349,1747498,1747639,1747642,1747646,1747650,1747661,1747956,1747959,1747963,1748121,1748133,1748206,1748218,1748223,1748260,1748357,1748394,1748401,1748543,1748559,1748628,1748689,1748693,1748703,1748837,1748854,1748907,1748925,1748929,1748944,1748972,1749026,1749083,1749092,1749111,1749220
Modified: ofbiz/branches/release15.12/.classpath
URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/.classpath?rev=1749221&r1=1749220&r2=1749221&view=diff
==============================================================================
--- ofbiz/branches/release15.12/.classpath (original)
+++ ofbiz/branches/release15.12/.classpath Sun Jun 19 22:30:58 2016
@@ -43,7 +43,7 @@
<classpathentry kind="lib" path="framework/base/lib/owasp-java-html-sanitizer-r239.jar"/>
<classpathentry kind="lib" path="framework/base/lib/resolver-2.9.1.jar"/>
<classpathentry kind="lib" path="framework/base/lib/serializer-2.9.1.jar"/>
- <classpathentry kind="lib" path="framework/base/lib/shiro-core-1.2.3.jar"/>
+ <classpathentry kind="lib" path="framework/base/lib/shiro-core-1.2.5.jar"/>
<classpathentry kind="lib" path="framework/base/lib/slf4j-api-1.6.4.jar"/>
<classpathentry kind="lib" path="framework/base/lib/tika-core-1.12.jar"/>
<classpathentry kind="lib" path="framework/base/lib/tika-parsers-1.12.jar"/>
Modified: ofbiz/branches/release15.12/LICENSE
URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/LICENSE?rev=1749221&r1=1749220&r2=1749221&view=diff
==============================================================================
--- ofbiz/branches/release15.12/LICENSE (original)
+++ ofbiz/branches/release15.12/LICENSE Sun Jun 19 22:30:58 2016
@@ -42,7 +42,7 @@ framework/base/lib/nekohtml-1.9.16.jar
framework/base/lib/pdfbox-1.8.12.jar
framework/base/lib/resolver-2.9.1.jar
framework/base/lib/serializer-2.9.1.jar
-framework/base/lib/shiro-core-1.2.3.jar
+framework/base/lib/shiro-core-1.2.5.jar
framework/base/lib/tika-core-1.12.jar
framework/base/lib/tika-parsers-1.12.jar
framework/base/lib/ws-commons-java5-1.0.1.jar
Modified: ofbiz/branches/release15.12/build.xml
URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/build.xml?rev=1749221&r1=1749220&r2=1749221&view=diff
==============================================================================
--- ofbiz/branches/release15.12/build.xml (original)
+++ ofbiz/branches/release15.12/build.xml Sun Jun 19 22:30:58 2016
@@ -1591,7 +1591,7 @@ under the License.
<classpath>
<path location="framework/base/build/lib/ofbiz-base.jar"/>
<path location="framework/base/lib/commons/commons-codec-1.10.jar"/>
- <path location="framework/base/lib/shiro-core-1.2.3.jar"/>
+ <path location="framework/base/lib/shiro-core-1.2.5.jar"/>
<path location="framework/base/lib/slf4j-api-1.6.4.jar"/>
</classpath>
</java>