You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@accumulo.apache.org by ct...@apache.org on 2017/07/05 22:57:25 UTC
[1/7] accumulo git commit: ACCUMULO-4676 Use HTTPOnly flags in monitor
Repository: accumulo
Updated Branches:
refs/heads/1.7 3d552ea41 -> 9e7e35842
refs/heads/1.8 c78605dad -> fab55895a
refs/heads/master 4cffe0290 -> e9573bf3b
ACCUMULO-4676 Use HTTPOnly flags in monitor
Add missing HTTPOnly flags on the JSESSIONID cookie in Monitor UI
This prevents certain kinds of XSS attacks by preventing
well-implemented browsers from allowing client-side code to access and
modify the JSESSIONID cookie.
This closes #278
Signed-off-by: Christopher Tubbs <ct...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/9e7e3584
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/9e7e3584
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/9e7e3584
Branch: refs/heads/1.7
Commit: 9e7e35842722b45b7bce0b13833d3dab0925e443
Parents: 3d552ea
Author: Toshihiro Suzuki <br...@gmail.com>
Authored: Tue Jul 4 14:05:03 2017 +0900
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:29:02 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/9e7e3584/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
diff --git a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
index f0213e7..d57b751 100644
--- a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
+++ b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
@@ -82,6 +82,8 @@ public class EmbeddedWebServer {
connector.setPort(port);
handler = new ServletContextHandler(server, "/", new SessionHandler(), new ConstraintSecurityHandler(), null, null);
+ handler.getSessionHandler().getSessionManager().getSessionCookieConfig().setHttpOnly(true);
+
disableTrace("/");
}
[2/7] accumulo git commit: ACCUMULO-4676 Use HTTPOnly flags in monitor
Posted by ct...@apache.org.
ACCUMULO-4676 Use HTTPOnly flags in monitor
Add missing HTTPOnly flags on the JSESSIONID cookie in Monitor UI
This prevents certain kinds of XSS attacks by preventing
well-implemented browsers from allowing client-side code to access and
modify the JSESSIONID cookie.
This closes #278
Signed-off-by: Christopher Tubbs <ct...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/9e7e3584
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/9e7e3584
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/9e7e3584
Branch: refs/heads/1.8
Commit: 9e7e35842722b45b7bce0b13833d3dab0925e443
Parents: 3d552ea
Author: Toshihiro Suzuki <br...@gmail.com>
Authored: Tue Jul 4 14:05:03 2017 +0900
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:29:02 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/9e7e3584/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
diff --git a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
index f0213e7..d57b751 100644
--- a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
+++ b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
@@ -82,6 +82,8 @@ public class EmbeddedWebServer {
connector.setPort(port);
handler = new ServletContextHandler(server, "/", new SessionHandler(), new ConstraintSecurityHandler(), null, null);
+ handler.getSessionHandler().getSessionManager().getSessionCookieConfig().setHttpOnly(true);
+
disableTrace("/");
}
[7/7] accumulo git commit: ACCUMULO-4673 Fix formatting
Posted by ct...@apache.org.
ACCUMULO-4673 Fix formatting
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/e9573bf3
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/e9573bf3
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/e9573bf3
Branch: refs/heads/master
Commit: e9573bf3bb6c6ee71cb21db038971280e01eb062
Parents: 7292e53
Author: Christopher Tubbs <ct...@apache.org>
Authored: Wed Jul 5 18:54:28 2017 -0400
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:54:28 2017 -0400
----------------------------------------------------------------------
proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/e9573bf3/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
----------------------------------------------------------------------
diff --git a/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java b/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
index a9919a7..7ff42fe 100644
--- a/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
+++ b/proxy/src/main/java/org/apache/accumulo/proxy/Proxy.java
@@ -135,8 +135,7 @@ public class Proxy implements KeywordExecutable {
if (is != null) {
props.load(is);
} else {
- System.err.println("proxy.properties needs to be specified as argument (using -p) or on "
- + "the classpath (by putting the file in conf/)");
+ System.err.println("proxy.properties needs to be specified as argument (using -p) or on the classpath (by putting the file in conf/)");
System.exit(-1);
}
}
[3/7] accumulo git commit: ACCUMULO-4676 Use HTTPOnly flags in monitor
Posted by ct...@apache.org.
ACCUMULO-4676 Use HTTPOnly flags in monitor
Add missing HTTPOnly flags on the JSESSIONID cookie in Monitor UI
This prevents certain kinds of XSS attacks by preventing
well-implemented browsers from allowing client-side code to access and
modify the JSESSIONID cookie.
This closes #278
Signed-off-by: Christopher Tubbs <ct...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/9e7e3584
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/9e7e3584
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/9e7e3584
Branch: refs/heads/master
Commit: 9e7e35842722b45b7bce0b13833d3dab0925e443
Parents: 3d552ea
Author: Toshihiro Suzuki <br...@gmail.com>
Authored: Tue Jul 4 14:05:03 2017 +0900
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:29:02 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/9e7e3584/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
diff --git a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
index f0213e7..d57b751 100644
--- a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
+++ b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
@@ -82,6 +82,8 @@ public class EmbeddedWebServer {
connector.setPort(port);
handler = new ServletContextHandler(server, "/", new SessionHandler(), new ConstraintSecurityHandler(), null, null);
+ handler.getSessionHandler().getSessionManager().getSessionCookieConfig().setHttpOnly(true);
+
disableTrace("/");
}
[4/7] accumulo git commit: Merge branch '1.7' into 1.8
Posted by ct...@apache.org.
Merge branch '1.7' into 1.8
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/fab55895
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/fab55895
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/fab55895
Branch: refs/heads/master
Commit: fab55895a490237f1d33cf89a260d3e790a1d68c
Parents: c78605d 9e7e358
Author: Christopher Tubbs <ct...@apache.org>
Authored: Wed Jul 5 18:37:04 2017 -0400
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:37:04 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/fab55895/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
[5/7] accumulo git commit: Merge branch '1.7' into 1.8
Posted by ct...@apache.org.
Merge branch '1.7' into 1.8
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/fab55895
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/fab55895
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/fab55895
Branch: refs/heads/1.8
Commit: fab55895a490237f1d33cf89a260d3e790a1d68c
Parents: c78605d 9e7e358
Author: Christopher Tubbs <ct...@apache.org>
Authored: Wed Jul 5 18:37:04 2017 -0400
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:37:04 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/fab55895/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
[6/7] accumulo git commit: Merge branch '1.8'
Posted by ct...@apache.org.
Merge branch '1.8'
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/7292e539
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/7292e539
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/7292e539
Branch: refs/heads/master
Commit: 7292e5399ef81698694950f9b7a0c74e4efc21c6
Parents: 4cffe02 fab5589
Author: Christopher Tubbs <ct...@apache.org>
Authored: Wed Jul 5 18:43:59 2017 -0400
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:43:59 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------