You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ofbiz.apache.org by Bilgin Ibryam <bi...@gmail.com> on 2011/01/04 21:32:26 UTC

Re: ajaxAutocompleteOptions screen

On Fri, Dec 17, 2010 at 9:12 AM, Jacques Le Roux <
jacques.le.roux@les7arts.com> wrote:

> Hi,
>
> I wonder about this in ajaxAutocompleteOptions screen
> framework/common/widget/CommonScreens.xml
> <<FindAutocompleteOptions.groovy   FIXME: Disabled because it represents a
> security hole.>>
>
> Should we care about it, or simply remove the commentted out snippet?
>
> Thanks
>
> Jacques
>
>
You can remove the comment without worries. It applies to the old version of
the FindAutocompleteOptions.groovy where entityName was retrieved from
parameters, thus allowing users to query any entity.

Bilgin

Re: ajaxAutocompleteOptions screen

Posted by Jacques Le Roux <ja...@les7arts.com>.

From: "Bilgin Ibryam" <bi...@gmail.com>
> On Fri, Dec 17, 2010 at 9:12 AM, Jacques Le Roux <
> jacques.le.roux@les7arts.com> wrote:
> 
>> Hi,
>>
>> I wonder about this in ajaxAutocompleteOptions screen
>> framework/common/widget/CommonScreens.xml
>> <<FindAutocompleteOptions.groovy   FIXME: Disabled because it represents a
>> security hole.>>
>>
>> Should we care about it, or simply remove the commentted out snippet?
>>
>> Thanks
>>
>> Jacques
>>
>>
> You can remove the comment without worries. It applies to the old version of
> the FindAutocompleteOptions.groovy where entityName was retrieved from
> parameters, thus allowing users to query any entity.
> 
> Bilgin

Thanks Bilgin,

Done at r1055370

Jacques