You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@jackrabbit.apache.org by "Konrad Windszus (Jira)" <ji...@apache.org> on 2026/10/20 09:50:00 UTC

[jira] [Closed] (JCRVLT-856) Install Hooks do not properly validate admin access

     [ https://issues.apache.org/jira/browse/JCRVLT-856?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Konrad Windszus closed JCRVLT-856.
----------------------------------

> Install Hooks do not properly validate admin access
> ---------------------------------------------------
>
>                 Key: JCRVLT-856
>                 URL: https://issues.apache.org/jira/browse/JCRVLT-856
>             Project: Jackrabbit FileVault
>          Issue Type: Bug
>            Reporter: Konrad Windszus
>            Assignee: Konrad Windszus
>            Priority: Major
>             Fix For: 4.3.0
>
>
> A package can contain hidden code (in install hookes) that runs on the server as soon as the package is opened for installation. The system starts this code before checking whether the user has permission to install packages with hooks. So an unauthorized user can trigger the code, and only afterward is the install refused. The problem affects normal installs, though test runs (dry runs) skip this step.
> https://github.com/apache/jackrabbit-filevault-private/issues/3



--
This message was sent by Atlassian Jira
(v8.20.10#820010)