You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "Krishnauprit18 (via GitHub)" <gi...@apache.org> on 2026/08/24 05:37:05 UTC
[PR] Improved externalLoginKey handling for cross-application navigation [ofbiz-framework]
Krishnauprit18 opened a new pull request, #1710:
URL: https://github.com/apache/ofbiz-framework/pull/1710
- External login keys are now single-use per webapp and time-limited, instead of a reusable token stored indefinitely in a JVM-wide map.
- Key is no longer attached to inter-app link targets that carry a scheme or a network-path authority (widget links and tree links).
- A failed base-permission/logout check is now treated as a no-op instead of proceeding with a null userLogin.
- Key usage is tracked per webapp, so a key stays usable for the other webapps it was issued for.
- Added unit test coverage for key reuse rejection and the inter-app absolute-target check; fixed an NPE in the replay test caused by an unstubbed getServletContext().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved externalLoginKey handling for cross-application navigation [ofbiz-framework]
Posted by "jacopoc (via GitHub) via notifications" <no...@ofbiz.apache.org>.
jacopoc commented on PR #1710:
URL: https://github.com/apache/ofbiz-framework/pull/1710#issuecomment-6637569064
CVE-2026-82907
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Improved externalLoginKey handling for cross-application navigation [ofbiz-framework]
Posted by "ashishvijaywargiya (via GitHub)" <gi...@apache.org>.
ashishvijaywargiya merged PR #1710:
URL: https://github.com/apache/ofbiz-framework/pull/1710
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org