(ofbiz-framework) branch trunk updated: Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689)

[mr...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 5611b685dc Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689)
5611b685dc is described below

commit 5611b685dcf7c1221f04935fab835f8f5a5397c9
Author: Mridul Pathak <mr...@gmail.com>
AuthorDate: Fri Oct 16 13:09:29 2026 +0530

    Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689)
    
    Uploads stored as LOCAL_FILE data resources are written under ${ofbiz.home}/runtime/uploads/ (content.upload.path.prefix), but the default content.data.local.file.allowed.paths only allowed ${ofbiz.home}/runtime/tmp/, so SecurityUtil.checkLocalFileAllowList rejected every such upload with "Access to file denied: path is not within an allowed directory" and the transaction rolled back, and LOCAL_FILE resources uploaded earlier could no longer be rendered. Add the upload directory to th [...]
---
 framework/security/config/security.properties | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties
index 5d0c06ba79..65b1e4ff4a 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -188,7 +188,9 @@ content.data.ofbiz.file.allowed.paths=applications/,themes/,plugins/,runtime/
 # -- Allowed directories for the LOCAL_FILE / LOCAL_FILE_BIN data resource types (absolute paths).
 # -- Comma-separated, no spaces after commas. Use ${ofbiz.home} as a portable placeholder.
 # -- Only files whose resolved canonical path starts with one of these entries will be served.
-content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/
+# -- Must include the content upload directory (content.upload.path.prefix in content.properties),
+# -- otherwise uploads stored as LOCAL_FILE fail.
+content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/,${ofbiz.home}/runtime/uploads/
 
 # -- Allowed hosts for the URL_RESOURCE data resource type (comma-separated host names or host:port values).
 # -- Both exact matches and subdomain matches are supported: "example.com" also permits "cdn.example.com".