You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2020/02/14 09:26:12 UTC
[ofbiz-plugins] branch release17.12 updated: Improved: Temporarily
comment out the "stream" request-map in ecommerce controller for security
reason (OFBIZ-11348)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release17.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/release17.12 by this push:
new 6e7f6a4 Improved: Temporarily comment out the "stream" request-map in ecommerce controller for security reason (OFBIZ-11348)
6e7f6a4 is described below
commit 6e7f6a44954630bd4d204e736629adbb84996e49
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Fri Feb 14 10:22:15 2020 +0100
Improved: Temporarily comment out the "stream" request-map in ecommerce
controller for security reason
(OFBIZ-11348)
No functional change, simply amend the comment
---
ecommerce/webapp/ecommerce/WEB-INF/controller.xml | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
index 3afb377..c09031e 100644
--- a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
+++ b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
@@ -1834,10 +1834,11 @@ under the License.
<response name="error" type="view" value="main"/>
</request-map>
-<!-- A vulnerability has been reported to the OFBiz security team. We were able to quickly and quietly fix it in supported versions,
- but in the ecommerce component. To be able to release the 17.12.01 version with this vulnerability fixed we need to temporarily
- comment out the "stream" request-map in ecommerce controller. We will later fix the specific issue in ecommerce to put back the
- functionnalities allowed by the "stream" request-map in ecommerce controller. See OFBIZ-11348 -->
+<!-- A vulnerability has been reported to the OFBiz security team.
+ To be able to release the 17.12.01 version with this vulnerability fixed we need to temporarily
+ comment out the "stream" request-map in this controller. We will later fix the specific issue to put back the
+ functionalities allowed by the "stream" request-map in this controller, see OFBIZ-11353
+ This will be later be put back with OFBIZ-11349 -->
<!-- <request-map uri="stream">
<event type="java" path="org.apache.ofbiz.content.data.DataEvents" invoke="serveObjectData"/>
<response name="success" type="none"/>