You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by re...@apache.org on 2016/09/13 18:41:57 UTC
svn commit: r15350 - /dev/jackrabbit/2.6.6/
Author: reschke
Date: Tue Sep 13 18:41:57 2016
New Revision: 15350
Log:
Apache Jackrabbit 2.6.6 release candidate
Added:
dev/jackrabbit/2.6.6/
dev/jackrabbit/2.6.6/RELEASE-NOTES.txt
dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip (with props)
dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.asc
dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.md5
dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.sha
dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar (with props)
dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.asc
dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.md5
dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.sha
dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar (with props)
dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.asc
dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.md5
dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.sha
dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war (with props)
dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.asc
dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.md5
dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.sha
Added: dev/jackrabbit/2.6.6/RELEASE-NOTES.txt
==============================================================================
--- dev/jackrabbit/2.6.6/RELEASE-NOTES.txt (added)
+++ dev/jackrabbit/2.6.6/RELEASE-NOTES.txt Tue Sep 13 18:41:57 2016
@@ -0,0 +1,117 @@
+Release Notes -- Apache Jackrabbit -- Version 2.6.6
+
+Introduction
+------------
+
+This is Apache Jackrabbit(TM) 2.6, a fully compliant implementation of the
+Content Repository for Java(TM) Technology API, version 2.0 (JCR 2.0) as
+specified in the Java Specification Request 283 (JSR 283).
+
+Apache Jackrabbit 2.6.6 is a patch release that contains fixes and
+improvements over Jackrabbit 2.6. This release also contains a security fix
+for Jackrabbit 2.6.5 and earlier. Jackrabbit 2.6.x releases are considered
+stable and targeted for production use.
+
+Security advisory (JCR-3883 / CVE-2015-1833)
+--------------------------------------------
+
+This release fixes an important security issue in the jackrabbit-webdav module
+reported by Mikhail Egorov.
+
+When processing a WebDAV request body containing XML, the XML parser can be
+instructed to read content from network resources accessible to the host,
+identified by URI schemes such as "http(s)" or "file". Depending on the
+WebDAV request, this can not only be used to trigger internal network
+requests, but might also be used to insert said content into the request,
+potentially exposing it to the attacker and others (for instance, by inserting
+said content in a WebDAV property value using a PROPPATCH request). See also
+IETF RFC 4918, Section 20.6.
+
+Users of the jackrabbit-webdav module are advised to immediately update the
+module to this release or disable WebDAV access to the repository.
+
+Changes since Jackrabbit 2.6.5
+------------------------------
+
+Bug
+
+ [JCR-3235] - ArrayIndexOfOufBounds in TargetImportHandler$BufferedStringValue.append()
+ [JCR-3693] - Lucene configuration - aggregation definition : problem with include-property tag
+ [JCR-3709] - DBDataStore updates 2 times the lastModified Date on touch when GC is running
+ [JCR-3710] - occasional test failures in TokenBasedAuthenticationTest
+ [JCR-3711] - RepositoryChecker versioning cleanup may leave repaired node in invalid type state
+ [JCR-3721] - Slow and actively called NodeId.toString()
+ [JCR-3761] - TokenInfo#resetExpiration always fails with ConstraintViolationException
+ [JCR-3770] - refine validateHierarchy check in order to avoid false-positives
+ [JCR-3773] - Lucene ConsistencyCheck reports nodes under jcr:nodeTypes as deleted
+ [JCR-3783] - Deadlock due to IOException in WorkspaceUpdateChannel.updatePrepared()
+ [JCR-3784] - ReplacePropertyWhileOthersReadTest fails when run with ConcurrentTestSuite
+ [JCR-3796] - TokenProvider.createToken is case sensitive
+ [JCR-3798] - NPE while building path in lucene index consistency checker
+ [JCR-3809] - ConnectionHelper swallows exception when it fails to reset binary streams after a failed SQL statement execution
+ [JCR-3811] - AppendRecord should allow reattempting database insertions of journal records should the initial attempt fail
+ [JCR-3814] - IllegalStateException in LockManager#unlock
+ [JCR-3821] - SeededSecureRandom thread can prevent Jackrabbit from shutting down
+ [JCR-3840] - NodeTypeDefDiff does not take same-name child type definitions into account
+ [JCR-3883] - Jackrabbit WebDAV bundle susceptible to XXE/XEE attack (CVE-2015-1833)
+ [JCR-3909] - CSRF bug in Jackrabbit-Webdav
+ [JCR-3949] - occasional test failure in RepositoryConfigTest.testAutomaticClusterNodeIdCreation()
+ [JCR-3950] - XSS in DirListingExportHandler
+ [JCR-4009] - CSRF in Jackrabbit-Webdav
+
+Improvement
+
+ [JCR-3573] - Improve token based login concurrency
+ [JCR-3628] - Embed cause in org.apache.jackrabbit.core.SessionImpl#getNodeByIdentifier while rethrowing IllegalArgumentException
+ [JCR-3687] - Backport improvements made to token based auth in OAK
+ [JCR-3810] - StreamWrapper can attempt to reset other types of InputStreams
+ [JCR-3826] - AbstractPrincipalProvider cachesize is not configurable
+
+In addition to the above-mentioned changes, this release contains
+all the changes included up to the Apache Jackrabbit 2.10.x release.
+
+For more detailed information about all the changes in this and other
+Jackrabbit releases, please see the Jackrabbit issue tracker at
+
+ https://issues.apache.org/jira/browse/JCR
+
+Release Contents
+----------------
+
+This release consists of a single source archive packaged as a zip file.
+The archive can be unpacked with the jar tool from your JDK installation.
+See the README.txt file for instructions on how to build this release.
+
+The source archive is accompanied by SHA1 and MD5 checksums and a PGP
+signature that you can use to verify the authenticity of your download.
+The public key used for the PGP signature can be found at
+https://svn.apache.org/repos/asf/jackrabbit/dist/KEYS.
+
+About Apache Jackrabbit
+-----------------------
+
+Apache Jackrabbit is a fully conforming implementation of the Content
+Repository for Java Technology API (JCR). A content repository is a
+hierarchical content store with support for structured and unstructured
+content, full text search, versioning, transactions, observation, and
+more.
+
+For more information, visit http://jackrabbit.apache.org/
+
+About The Apache Software Foundation
+------------------------------------
+
+Established in 1999, The Apache Software Foundation provides organizational,
+legal, and financial support for more than 140 freely-available,
+collaboratively-developed Open Source projects. The pragmatic Apache License
+enables individual and commercial users to easily deploy Apache software;
+the Foundation's intellectual property framework limits the legal exposure
+of its 3,800+ contributors.
+
+For more information, visit http://www.apache.org/
+
+Trademarks
+----------
+
+Apache Jackrabbit, Jackrabbit, Apache, the Apache feather logo, and the Apache
+Jackrabbit project logo are trademarks of The Apache Software Foundation.
\ No newline at end of file
Added: dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip
==============================================================================
Binary file - no diff available.
Propchange: dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.asc
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.asc (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.asc Tue Sep 13 18:41:57 2016
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJX2EKvAAoJEB3kYVKPHxsqs18QALNAhT/+OosQpuvPilZ5Z9+b
+WyBcBaRofagGwGQwj6QwIEJvMr6Az6MEgCWglDTM6iP5rcuCtswxXnABxNrWCfRt
+4qVthaf0kQavZoMW5YIb6q5X9H6WrSkznUin+uDciBnIOp6E3prQVfH9QM96qXPe
+SxZTQeWtYFrT3PkP2SmeCrdNw8o3DEzCsoyCctPnS5u+IYZ4eceCTofWE8XBT1od
+TQ23ko2w2ihI1zabU4Z5CRFkeP150eYXxAfi2ulbHiUAi3gyFY9Kg+v3TpRwRv2i
+yapLonUnWRbFVF3yrxpQopLJEJUQ4FKPcr8ODkErw76AWBmkBUvyq/0jKwiTCP2o
+4bSq9JtOVo66kVisNvaGDbksdLTa8coj5dB+kN+DV/vgjgIMevmjKS50xcuFBNfY
+g2TZuLfzPmnWObrwPgGEXbpFkVzkv7Y+35aTvKJ9ypfydBqEAOzoNbJP6ywcmCKS
+6sqrwEuzLcM0+ruVyC1vcKAp19YyDMs293d7qpDO164bKKnttPiQBTKPwIxVlRLE
+4YfdFfKt1/5YGQqiRszFK5kBejr/q5yZdasg+G/5bbq5z51/i1o+2iG3tXwynDu1
+3I0L02orE0miRKQUjB5bIbIczHosrOUgfhi4jwKOd4oez+/hU/wF57ZkfenWeYUS
+XGZyjfpL/PJiD1lJ3P9G
+=Rkwl
+-----END PGP SIGNATURE-----
Added: dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.md5
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.md5 (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.md5 Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+8642019adb17a732fabcd950d173b51b
Added: dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.sha
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.sha (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-2.6.6-src.zip.sha Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+94e9d74cb4b2c83a2b680ea3b61e6349f9ed362b
Added: dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar
==============================================================================
Binary file - no diff available.
Propchange: dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.asc
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.asc (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.asc Tue Sep 13 18:41:57 2016
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJX2EEnAAoJEB3kYVKPHxsqDBAP/0VsEsfsduGxtNB478ifxUSH
+FQN1bERvtE3YrpViTW08N1NT4I0N0c7vSAtmRwHqUZFLEZhXCdOW891gpl9obmUM
+Fl4DUm8U2tUAswRfBJDgNATe4hlAzqAfkFKF3gnGNYI329bNfp/6n5pAaKxDGwUK
+s8x1uwQviC1b3I3DIP3wa4EKFsitF5rfB98YS9G3X86quniJieYqUkr/K35D6fbV
+xgo/ePhSrW9QEiyrHgI6uLk6u9Qg1t6G2IYkevOMJjpYCanwV1PzQOx+3SzAf/SL
+ppr2EZXlOy73bR5PO2nI1kw9VmQqp6uehSaTAVMsnXzR2aeT1i0lIbMrgp9x6ru0
+5zORpgXnCAQnXnAxGxsYIND/TS7bHdk4YF/TLb4rHKkR3g6qytd50YthR0e+KgIS
+ryzM1WprbiEbgSM0UMn+oDep0Yhry3RZhaX954oEgeMMgMHB3IW2WCDwrG4afBZ0
+7ksACIo0n0Qd4iVU1FkCzbI499+CmyHr6pQopkMLmSMO4HhfuO2OZKw6uIQcvKNJ
+Wk7sSRZXeEl2jgdtAdxgPC7O1wdxnCXnCuF1tJAGg62YYzfJBoqw+CLmJhGPYZdn
+BpPn+VzxbBEYf/qhdTgJTXc8RfzZc6ccpyFrBfR8U2OA0ExhGEOndt4Gsnpc1jj2
+waICRJuJ5/rvXCy4Edoz
+=kwoR
+-----END PGP SIGNATURE-----
Added: dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.md5
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.md5 (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.md5 Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+72e06d95b587d71af9930a26d7f67cd6
Added: dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.sha
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.sha (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-jca-2.6.6.rar.sha Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+3e089df7208a1ae0260b9f66c707565725a7b571
Added: dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar
==============================================================================
Binary file - no diff available.
Propchange: dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.asc
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.asc (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.asc Tue Sep 13 18:41:57 2016
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJX2EKlAAoJEB3kYVKPHxsqjAYP/1qhFK4R/102GzCoImoN2DCu
+wEJF74SsXrYC3BQADuMzRliI4EoOUpNIGJYPJbfF4C611gEjlCWWrL/FDKBiq1n3
+rjZI2xEWSxc3cNEW9j9BBzFyyvtOsY8iFFslSoBgwe6w26LlLVNAFMCfGFXfpVVk
+3xOa6xpU9ZkkkBqvKVld2xiV3xJTtvyIZkA0zQxv9xcRaSWjzHzZU1z10VQ/4F7/
+dRwpNgpVemJgEfhFhWIt81LfR7iS3fJCotngO6aSDNzrptho/gJZpvp0XWwm21cH
+DHvgGatUTI8Dw+wjZ9aRUHxrMJLqxmnhkNVgjHpfdJTSFbIn1ler5RVtZzmvT0zw
++j/fDgvgCM8ueeNGtW9J94EsjeryTuDpcMf/jjEjB+NRmUU3y3mxg2PeWhTuDnPh
+KLj5jCRLpWO5Tg4BtIvbqRVgAUw7wtRqc0l961U1dSw67KBK1MbSEQr/lp+AmIHD
+YXjP/5nMyS3f1F+BFKOtQp7j/ZyQD52eRCWJuBGZ7+lILu8/km2/ntndvEuOxKBV
+kvE8f2mOcXU/LJaFISeXtdEwxCd35EuawxdAMe4sHYYm2quj2voH+eNHNyu1IVP5
+RrA8Lll4exzgt5YBitJOs6Uc/Ori1FA9Y3MUUCEfiOM0ix9FgLZuR57392LZjtg5
+HG5TWTZSfe5eYSr9pDMr
+=aiJu
+-----END PGP SIGNATURE-----
Added: dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.md5
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.md5 (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.md5 Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+dc3379594fdd8f655782f4daf1498c4b
Added: dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.sha
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.sha (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-standalone-2.6.6.jar.sha Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+ad270aafe25f3ca2106d31bd1374f00b6e76f1d8
Added: dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war
==============================================================================
Binary file - no diff available.
Propchange: dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.asc
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.asc (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.asc Tue Sep 13 18:41:57 2016
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJX2EDJAAoJEB3kYVKPHxsqgi8P/2IOmwld4Xb7kfQ5a8020Mf0
+TfQnJg+COw72Yu6Z6GLykSs6rxzyG+VGgyWTUCE+kGcmON0Eo3Y4lnEN3Lyrz/gy
+UrSxxEuLn6p5lcap52oRS5dEKD5+c/fJwxn9cETJgDP38ZKdHNlP3QRO26/W2SOH
+3qx2H/oDL0z6cFNQzRbwPUm8Lg2V9erQQKDaSMT+XytWuwX8kKu4Az+ZvwSjkNF7
+tO0Ez+IfUvqfhbYLXo9HCvAwL61Ecx1mknRfDJI2QmWigQhr9UYWjeWub24r+xZc
+Rp6Crmx8oES1DD/UeGltrya8HHYvlcD2/Hzh8rN8IdOhwg2DWWgaKxd/VARuxyeI
+xTPr0mPg4EnFC03UbyN8/aP1klKA+Rl1l1zAqX19OWGB7k6ufkSQkvwSp1ZOcANm
++1yPu/3WtPDslT6YwrOFZgVWKE6jkl4G8rcYSZTlTxygSiZO2nbfz5zb/Kg59WL5
+/pdQH11HqVFe8ILYKVkHby8KB/9Eyp6/jNNx04tay1XI9jXskpJQfULWvw/KEXnP
+ziK/6y3U5IkpRwp3hrVS4q2stDeobk1YnZ0yGNpodxuogXyo1j9KendEC2bAI4Lw
+/N4DJaSKxm6d3Ji5JiygHGgvd46H4PKJUX+Rovot/Nop58o23VBquTwPZharxOYT
+xcyv7AATtWsflq9a0UGd
+=IZD7
+-----END PGP SIGNATURE-----
Added: dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.md5
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.md5 (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.md5 Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+4b81b406e8691795d83541310c202539
Added: dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.sha
==============================================================================
--- dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.sha (added)
+++ dev/jackrabbit/2.6.6/jackrabbit-webapp-2.6.6.war.sha Tue Sep 13 18:41:57 2016
@@ -0,0 +1 @@
+d2dc5b782bb50f16e0785c2134b4bb76c86261c7