[jira] [Commented] (SOLR-12279) Validate Boolean "bin/solr auth" Inputs

["ASF subversion and git services (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SOLR-12279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16465809#comment-16465809 ] 

ASF subversion and git services commented on SOLR-12279:
--------------------------------------------------------

Commit 6521d86dded91e6666f8d85c22076a748b6c2525 in lucene-solr's branch refs/heads/master from [~gerlowskija]
[ https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=6521d86 ]

SOLR-12279: Reject invalid 'blockUnknown' values for 'bin/solr auth'


> Validate Boolean "bin/solr auth" Inputs
> ---------------------------------------
>
>                 Key: SOLR-12279
>                 URL: https://issues.apache.org/jira/browse/SOLR-12279
>             Project: Solr
>          Issue Type: Bug
>      Security Level: Public(Default Security Level. Issues are Public) 
>          Components: scripts and tools
>    Affects Versions: master (8.0)
>            Reporter: Jason Gerlowski
>            Assignee: Jason Gerlowski
>            Priority: Trivial
>         Attachments: SOLR-12279.patch, repro.sh
>
>
> The "auth" command in the {{bin/solr}} scripts has a handful of different parameters which take in boolean arguments.  However, {{bin/solr}} blithely accepts invalid values without warning administrators in any way of the mistake.
> In most cases, the results are innocuous.  But in some cases, silently handling invalid input causes real issues.  Consider:
> {code}
> $ bin/solr auth enable -type basicAuth -credentials anyUser:anyPass -blockUnknown ture
> Successfully enabled basic auth with username [anyUser] and password [anyPass].
> $ bin/solr auth enable -type basicAuth -credentials anyUser:anyPass -blockUnknown ture
> Security is already enabled. You can disable it with 'bin/solr auth disable'. Existing security.json:
> {
>   "authentication":{
>    "blockUnknown": false,
>    "class":"solr.BasicAuthPlugin",
>    "credentials":{"mount":"3FLVxpOGLt4dlqlyqxgsiFDbGX+i+dc81L6qEhuBdcI= lrH1W1pFGyGoAdTJ/Isuclh042fvz66ggG7YZ4e7YwA="}
>   },
>   ...
> }
> {code}
> If an administrator accidentally mistypes or fatfingers "true" when enabling authentication, their Solr instance will remain unprotected without any warning! 
> The {{bin/solr auth}} tool should refuse to process invalid boolean arguments, or at the least spit out a warning in such cases.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org