You are viewing a plain text version of this content. The canonical link for it is here.
Posted to solr-dev@lucene.apache.org by "Simon Rosenthal (JIRA)" <ji...@apache.org> on 2009/10/13 20:16:31 UTC
[jira] Created: (SOLR-1509) Admin UI display of schema.xml can't
find schema file
Admin UI display of schema.xml can't find schema file
-----------------------------------------------------
Key: SOLR-1509
URL: https://issues.apache.org/jira/browse/SOLR-1509
Project: Solr
Issue Type: Bug
Affects Versions: 1.4
Reporter: Simon Rosenthal
Priority: Minor
This is in a multicore enviroment: solr.xml contains
<solr sharedLib="lib" shareSchema="true" persistent="true">
<cores adminPath="/admin/cores">
<core default="true" instanceDir="core1" name="core1"
config="/home/solrdata/rig1/conf/solrconfig.xml"
schema="/home/solrdata/rig1/conf/schema.xml" >
<property name="dataDir" value="/home/solrdata/rig1/core1" />
</core>
<core default="false" instanceDir="core2" name="core2"
... schema same as above
</core>
...
</cores>
When I go to the URL /solr/core1/admin/ and click on the schema link, the URL displayed by the browser is
http://host:port/solr/core1/admin/file/?file=/home/solrdata/rig1/conf/schema.xml
which looks correct, but a HTTP 400 error is displayed in of the form
Can not find: schema.xml [/path/to/core1/conf/directory/home/solrdata/rig1/conf/schema.xml]
looks as though it's blindly appending the schema.xml path to the conf directory, even though it's not a relative one.
Same for other cores
The schema browser link on the admin page works fine.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (SOLR-1509) Admin UI display of schema.xml can't
find schema file
Posted by "Hoss Man (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SOLR-1509?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12765248#action_12765248 ]
Hoss Man commented on SOLR-1509:
--------------------------------
The only bug here is the confusing error message.
the ShowFileRequestHandler (which is what powers /admin/file in 90% of all solrconfigs) is specifically documented to only allow access to files in the conf directory -- this constraint is put in place to prevent it from being abused to try and access files that admin console users shouldn't be allowed to see (ie: /etc/passwd)
> Admin UI display of schema.xml can't find schema file
> -----------------------------------------------------
>
> Key: SOLR-1509
> URL: https://issues.apache.org/jira/browse/SOLR-1509
> Project: Solr
> Issue Type: Bug
> Affects Versions: 1.4
> Reporter: Simon Rosenthal
> Priority: Minor
>
> This is in a multicore enviroment: solr.xml contains
> <solr sharedLib="lib" shareSchema="true" persistent="true">
> <cores adminPath="/admin/cores">
> <core default="true" instanceDir="core1" name="core1"
> config="/home/solrdata/rig1/conf/solrconfig.xml"
> schema="/home/solrdata/rig1/conf/schema.xml" >
> <property name="dataDir" value="/home/solrdata/rig1/core1" />
> </core>
> <core default="false" instanceDir="core2" name="core2"
> ... schema same as above
> </core>
> ...
> </cores>
>
> When I go to the URL /solr/core1/admin/ and click on the schema link, the URL displayed by the browser is
> http://host:port/solr/core1/admin/file/?file=/home/solrdata/rig1/conf/schema.xml
>
> which looks correct, but a HTTP 400 error is displayed in of the form
>
> Can not find: schema.xml [/path/to/core1/conf/directory/home/solrdata/rig1/conf/schema.xml]
>
> looks as though it's blindly appending the schema.xml path to the conf directory, even though it's not a relative one.
> Same for other cores
> The schema browser link on the admin page works fine.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (SOLR-1509) ShowFileRequestHandler has missleading
error when asked for absolute path
Posted by "Hoss Man (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SOLR-1509?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Hoss Man updated SOLR-1509:
---------------------------
Description:
When a user attempts to use the ShowFileRequestHandler (ie: /admin/file ) to access a file using an absolute path (which may result from solr.xml containing an absolute path for schema.xml or solrconfig.xml outside of the normal conf dir) then the error message indicates that a file with the path consisting of the confdir + the absolute path can't be found. the Handler should explicitly check for absolute paths (like it checks for ".." and error message should make it clear that absolute paths are not allowed.
Example of current behavior...
{noformat}
schema path = /home/solrdata/rig1/conf/schema.xml
url displayed in admin form = http://host:port/solr/core1/admin/file/?file=/home/solrdata/rig1/conf/schema.xml
error message: Can not find: schema.xml [/path/to/core1/conf/directory/home/solrdata/rig1/conf/schema.xml]
{noformat}
was:
This is in a multicore enviroment: solr.xml contains
<solr sharedLib="lib" shareSchema="true" persistent="true">
<cores adminPath="/admin/cores">
<core default="true" instanceDir="core1" name="core1"
config="/home/solrdata/rig1/conf/solrconfig.xml"
schema="/home/solrdata/rig1/conf/schema.xml" >
<property name="dataDir" value="/home/solrdata/rig1/core1" />
</core>
<core default="false" instanceDir="core2" name="core2"
... schema same as above
</core>
...
</cores>
When I go to the URL /solr/core1/admin/ and click on the schema link, the URL displayed by the browser is
http://host:port/solr/core1/admin/file/?file=/home/solrdata/rig1/conf/schema.xml
which looks correct, but a HTTP 400 error is displayed in of the form
Can not find: schema.xml [/path/to/core1/conf/directory/home/solrdata/rig1/conf/schema.xml]
looks as though it's blindly appending the schema.xml path to the conf directory, even though it's not a relative one.
Same for other cores
The schema browser link on the admin page works fine.
Summary: ShowFileRequestHandler has missleading error when asked for absolute path (was: Admin UI display of schema.xml can't find schema file)
updating issue summary/description
> ShowFileRequestHandler has missleading error when asked for absolute path
> -------------------------------------------------------------------------
>
> Key: SOLR-1509
> URL: https://issues.apache.org/jira/browse/SOLR-1509
> Project: Solr
> Issue Type: Bug
> Affects Versions: 1.4
> Reporter: Simon Rosenthal
> Priority: Minor
>
> When a user attempts to use the ShowFileRequestHandler (ie: /admin/file ) to access a file using an absolute path (which may result from solr.xml containing an absolute path for schema.xml or solrconfig.xml outside of the normal conf dir) then the error message indicates that a file with the path consisting of the confdir + the absolute path can't be found. the Handler should explicitly check for absolute paths (like it checks for ".." and error message should make it clear that absolute paths are not allowed.
> Example of current behavior...
> {noformat}
> schema path = /home/solrdata/rig1/conf/schema.xml
> url displayed in admin form = http://host:port/solr/core1/admin/file/?file=/home/solrdata/rig1/conf/schema.xml
> error message: Can not find: schema.xml [/path/to/core1/conf/directory/home/solrdata/rig1/conf/schema.xml]
> {noformat}
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.