You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by gi...@apache.org on 2026/03/21 06:57:55 UTC
(ofbiz-framework) branch dependabot/npm_and_yarn/themes/common-theme/webapp/common-theme/js/jquery-migrate-4.0.2 updated (938e24c6f8 -> b5af64f7a6)
This is an automated email from the ASF dual-hosted git repository.
github-bot pushed a change to branch dependabot/npm_and_yarn/themes/common-theme/webapp/common-theme/js/jquery-migrate-4.0.2
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
discard 938e24c6f8 Bump jquery-migrate in /themes/common-theme/webapp/common-theme/js
add cf6b743b6b No functional change, try to see if that helps on demo
add 46a8e3d859 Fixed: Some widget form targets violate security checks (OFBIZ-)
add 8cf3447e2d Fixed: Set template directory permissions in docker container images (OFBIZ-13363) (#967)
add 5bb12e6693 Implemented: Expand SECURITY.md to provide a comprehensive security model and policy for the Apache OFBiz project.
add 6a44d0d084 Bump dompurify from 3.3.1 to 3.3.2 in /themes/common-theme/webapp/common-theme/js (#971)
add a2b6d5041c Improved: Made wording for error during login consistent across supported languages (OFBIZ-13340) (#937)
add 185c9a0406 Implemented: Remove demo secret keys from security.property and add a gradle task to generate and set the keys
add 6d67f2576c Improved: Enhance GroovyUtil with secure AST customizations for eval() expressions to implement an execution sandbox
add 05a0676c28 Implemented: Introduce RestrictedStaticModels to enforce whitelist access to static methods and fields by means of the FreeMarker "Static" shared variable
add af8ee514a2 Improved: Enhance data resource validation and permission checks
add 82e3a64b8b Fixed: Update viewShipmentLabel request to require authentication
add 8b1f839447 Fixed: Validate URLs in widget factories to reject invalid locations
add e14e48c7e5 Fixed: Enhance sanitization of FreeMarker parameters to check both strings and lists
add d469a7823a Fixed: Enhance URL verification to handle jar URLs
add da0febe182 Improved: Enhance file upload validation with allowlist and path checks
add dd30bb1905 Bump dompurify from 3.3.2 to 3.3.3 in /themes/common-theme/webapp/common-theme/js (#980)
add 8c5af7e34b Align securedLoginId cookie processing with JWT-based verification (#981)
add a6ad227039 Enable rebase button in .asf.yaml of the trunk branch
add d4422b0f98 Improve parameter handling and JSON construction in form renderer and related macros (#982)
add 5d2ee2e9c0 Abandoned: Dependency verification (OFBIZ-12186)
add c170232f98 Improved the code of ProgramExport and did the sandboxing/sanitising enhancements for the groovy script use. (#984)
add 433dd85e0b Improved: Allow opting-out from the whitelist-restricted static models in freemarker (OFBIZ-13371)
add 3475b96c67 Fixed: Improve image upload handling by using file extensions for temporary files and ensuring safe copying of sanitized images
add 23f13adc01 Fixed: Enhance temporary file handling for uploads by using original file extensions and ensuring safe copying of files
add 0dcd1faf18 Fixed: Enhance temporary file creation for image uploads by using original file extensions and ensuring safe copying to the destination
add 341154bde2 Improved: No functional change
add aa684ad140 Fixed: Ensure safe writing of sanitized images by opening output stream after image processing
add a86cbb95db Bump moment-timezone from 0.6.0 to 0.6.1 in /themes/common-theme/webapp/common-theme/js (#992)
add 9675e8290c Fixed: Suppress warning for try block in isPdfFile method
add cd8cf2e77f Bump Node.js version to 20.19.0 and update package-lock.json
add 7efe1c15c0 Improved: this follows commit 185c9a0 and GH PR-981
add a93b04bbb2 Remove duplicated npm configuration from dependabot.yml
add 073a359dda Fixed: DateTime pickers displayed according to the locale (OFBIZ-13328) (#933)
add b5af64f7a6 Bump jquery-migrate in /themes/common-theme/webapp/common-theme/js
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (938e24c6f8)
\
N -- N -- N refs/heads/dependabot/npm_and_yarn/themes/common-theme/webapp/common-theme/js/jquery-migrate-4.0.2 (b5af64f7a6)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.asf.yaml | 4 +-
.github/dependabot.yml | 5 -
Dockerfile | 4 +-
SECURITY.md | 95 ++++-
VERSION | 2 +-
applications/content/servicedef/services_data.xml | 2 +
.../org/apache/ofbiz/content/data/DataEvents.java | 10 +-
.../ofbiz/content/data/DataResourceWorker.java | 272 ++++++++++++-
.../apache/ofbiz/content/data/DataServices.java | 37 +-
.../content/widget/content/DataResourceForms.xml | 6 +-
.../product/catalog/category/EditCategory.groovy | 6 +
.../config/EditProductConfigItemContent.groovy | 6 +
.../catalog/imagemanagement/ImageUpload.groovy | 6 +
.../catalog/imagemanagement/SetDefaultImage.groovy | 12 +
.../catalog/product/EditProductContent.groovy | 6 +
.../ofbiz/product/imagemanagement/FrameImage.java | 14 +-
.../imagemanagement/ImageManagementServices.java | 41 +-
.../ofbiz/product/product/ProductServices.java | 74 +++-
.../product/webapp/facility/WEB-INF/controller.xml | 2 +-
.../product/widget/catalog/FeatureForms.xml | 4 +-
build.gradle | 32 +-
.../src/main/groovy/ofbiz-node-conventions.gradle | 2 +-
.../org/apache/ofbiz/base/util/GroovyUtil.java | 43 +-
.../ofbiz/base/util/HttpRequestFileUpload.java | 19 +-
.../java/org/apache/ofbiz/base/util/UtilXml.java | 23 +-
.../ofbiz/base/util/template/FreeMarkerWorker.java | 47 ++-
.../base/util/template/RestrictedStaticModels.java | 178 ++++++++
framework/common/config/SecurityextUiLabels.xml | 20 +-
.../apache/ofbiz/entity/util/EntitySaxReader.java | 4 +-
.../config/freemarker-whitelist.properties | 159 ++++++++
framework/security/config/security.properties | 54 ++-
.../_include/sy-dependency-verification.adoc | 64 ---
framework/security/src/docs/asciidoc/security.adoc | 1 -
.../apache/ofbiz/security/SecuredFreemarker.java | 45 +-
.../org/apache/ofbiz/security/SecuredUpload.java | 451 +++++++++++++++++++--
.../ofbiz/service/engine/EntityAutoEngine.java | 7 +
.../apache/ofbiz/webapp/control/LoginWorker.java | 11 +
.../ofbiz/webtools/entity/ProgramExport.groovy | 158 +++++++-
.../org/apache/ofbiz/widget/model/FormFactory.java | 7 +
.../org/apache/ofbiz/widget/model/GridFactory.java | 7 +
.../org/apache/ofbiz/widget/model/MenuFactory.java | 3 +
.../apache/ofbiz/widget/model/ThemeFactory.java | 2 +-
.../org/apache/ofbiz/widget/model/TreeFactory.java | 4 +
.../ofbiz/widget/renderer/macro/FtlWriter.java | 16 +-
.../widget/renderer/macro/MacroFormRenderer.java | 40 +-
.../renderer/macro/renderable/RenderableFtl.java | 4 +-
.../macro/renderable/RenderableFtlMacroCall.java | 5 +-
.../macro/renderable/RenderableFtlNoop.java | 6 +-
.../macro/renderable/RenderableFtlSequence.java | 5 +-
.../macro/renderable/RenderableFtlString.java | 5 +-
.../macro/renderable/RenderableFtlVisitor.java | 8 +-
.../renderer/macro/MacroFormRendererTest.java | 10 +-
.../template/macro/HtmlFormMacroLibrary.ftl | 11 +-
.../webapp/common-theme/js/package-lock.json | 29 +-
.../webapp/common-theme/js/package.json | 4 +-
55 files changed, 1788 insertions(+), 304 deletions(-)
create mode 100644 framework/base/src/main/java/org/apache/ofbiz/base/util/template/RestrictedStaticModels.java
create mode 100644 framework/security/config/freemarker-whitelist.properties
delete mode 100644 framework/security/src/docs/asciidoc/_include/sy-dependency-verification.adoc