You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2026/01/31 15:45:03 UTC
(ofbiz-plugins) branch trunk updated: Improved: Comment out the SOAP and HTTP engines (OFBIZ-12212)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/trunk by this push:
new f40a59db9 Improved: Comment out the SOAP and HTTP engines (OFBIZ-12212)
f40a59db9 is described below
commit f40a59db95323742ab4d178a8c517b0ffbd7fb40
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sat Jan 31 16:43:39 2026 +0100
Improved: Comment out the SOAP and HTTP engines (OFBIZ-12212)
The SOAP and HTTP engines are open doors to security issues.
At https://markmail.org/message/pgtjyh23bazq4s2w I proposed to comment them out
as we did for RMI in the past.
---
ecommerce/webapp/ecommerce/WEB-INF/controller.xml | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
index 3d7fa706b..2a0f67fd8 100644
--- a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
+++ b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
@@ -26,7 +26,10 @@ under the License.
<handler name="java" type="request" class="org.apache.ofbiz.webapp.event.JavaEventHandler"/>
<handler name="groovy" type="request" class="org.apache.ofbiz.webapp.event.GroovyEventHandler"/>
- <!-- <handler name="soap" type="request" class="org.apache.ofbiz.webapp.event.SOAPEventHandler"/> -->
+ <!-- The service below have been commented out for security reason, see OFBIZ-12212 -->
+ <!-- If you feel it's ok with you (e.g. totally secured Internet access, or rather
+ no access at all which is safer!) you may uncomment and use. -->
+ <!-- <handler name="soap" type="request" class="org.apache.ofbiz.webapp.event.SOAPEventHandler"/> -->
<handler name="service" type="request" class="org.apache.ofbiz.webapp.event.ServiceEventHandler"/>
<handler name="service-multi" type="request" class="org.apache.ofbiz.webapp.event.ServiceMultiEventHandler"/>
<handler name="simple" type="request" class="org.apache.ofbiz.webapp.event.SimpleEventHandler"/>