You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ofbiz.apache.org by Nicolas Malin <ni...@nereide.fr> on 2025/10/13 07:17:44 UTC
Re: (ofbiz-framework) branch release24.09 updated: Improved: Check parameters passed in URLs (OFBIZ-13295)
Hello Jacques
On 12/10/2025 08:22, jleroux@apache.org wrote:
> --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
> +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
> @@ -174,11 +174,10 @@ public class ControlFilter extends HttpFilter {
> String context = req.getContextPath();
> HttpSession session = req.getSession();
>
> - // Prevents stream exploitation
> - if (!isSolrTest()) {
> - if (!isControlFilterTests()) {
> - UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
> - }
> + if (!(isSolrTest() || isControlFilterTests())) {
> + // Prevents stream exploitation
> + UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
> + UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
A reason to call twice the function
`UrlServletHelper.setRequestAttributes(req, null,
req.getServletContext())` ?
Nicolas
Re: (ofbiz-framework) branch release24.09 updated: Improved: Check parameters passed in URLs (OFBIZ-13295)
Posted by Nicolas Malin <ni...@nereide.fr>.
Nice :)
Thanks Jacques
On 13/10/2025 09:57, Jacques Le Roux wrote:
> Hi Nicolas,
>
> Oops no, missed that when handling conflicts by hand. I push it clean.
>
> Thanks
>
> Jacques
>
> Le 13/10/2025 à 09:17, Nicolas Malin a écrit :
>> Hello Jacques
>>
>> On 12/10/2025 08:22, jleroux@apache.org wrote:
>>> ---
>>> a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
>>> +++
>>> b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
>>> @@ -174,11 +174,10 @@ public class ControlFilter extends HttpFilter {
>>> String context = req.getContextPath();
>>> HttpSession session = req.getSession();
>>> - // Prevents stream exploitation
>>> - if (!isSolrTest()) {
>>> - if (!isControlFilterTests()) {
>>> - UrlServletHelper.setRequestAttributes(req, null,
>>> req.getServletContext());
>>> - }
>>> + if (!(isSolrTest() || isControlFilterTests())) {
>>> + // Prevents stream exploitation
>>> + UrlServletHelper.setRequestAttributes(req, null,
>>> req.getServletContext());
>>> + UrlServletHelper.setRequestAttributes(req, null,
>>> req.getServletContext());
>> A reason to call twice the function
>> `UrlServletHelper.setRequestAttributes(req, null,
>> req.getServletContext())` ?
>>
>> Nicolas
Re: (ofbiz-framework) branch release24.09 updated: Improved: Check parameters passed in URLs (OFBIZ-13295)
Posted by Jacques Le Roux <ja...@les7arts.com>.
Hi Nicolas,
Oops no, missed that when handling conflicts by hand. I push it clean.
Thanks
Jacques
Le 13/10/2025 à 09:17, Nicolas Malin a écrit :
> Hello Jacques
>
> On 12/10/2025 08:22, jleroux@apache.org wrote:
>> --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
>> +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
>> @@ -174,11 +174,10 @@ public class ControlFilter extends HttpFilter {
>> String context = req.getContextPath();
>> HttpSession session = req.getSession();
>> - // Prevents stream exploitation
>> - if (!isSolrTest()) {
>> - if (!isControlFilterTests()) {
>> - UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
>> - }
>> + if (!(isSolrTest() || isControlFilterTests())) {
>> + // Prevents stream exploitation
>> + UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
>> + UrlServletHelper.setRequestAttributes(req, null, req.getServletContext());
> A reason to call twice the function `UrlServletHelper.setRequestAttributes(req, null, req.getServletContext())` ?
>
> Nicolas