This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository
https://gitbox.apache.org/repos/asf/ofbiz-plugins.gitThe following commit(s) were added to refs/heads/trunk by this push:
new e5e7567 Fixed: The "stream" request-map in ecommerce and commonext controllers requires authentication (OFBIZ-11349)
e5e7567 is described below
commit e5e7567798bec6a11cd655300b8265c3953657d7
Author: Jacques Le Roux <
[hidden email]>
AuthorDate: Wed Feb 19 13:51:12 2020 +0100
Fixed: The "stream" request-map in ecommerce and commonext controllers
requires authentication
(OFBIZ-11349)
Thanks: Michael for reporting a possible issue when only commenting the "stream"
request-map in commonext controller. And Jacopo to suggest to require
authentication (after suggesting to comment out)
It should be also noted that when the CSRF defense implementation will be in
place, all XSS vulnerabilities w/o authentication will not longer be possible.
Because then all requests shall contains a CSRF token.
---
ecommerce/webapp/ecommerce/WEB-INF/controller.xml | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
index b26a528..5f7031c 100644
--- a/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
+++ b/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
@@ -1821,18 +1821,14 @@ under the License.
<response name="error" type="view" value="main"/>
</request-map>
-<!-- A vulnerability has been reported to the OFBiz security team.
- To be able to release the 17.12.01 version with this vulnerability fixed we need to temporarily
- comment out the "stream" request-map in this controller. We will later fix the specific issue to put back the
- functionalities allowed by the "stream" request-map in this controller, see OFBIZ-11353
- This will be later be put back with OFBIZ-11349 -->
-<!-- <request-map uri="stream">
+ <request-map uri="stream">
+ <security https="true" auth="true"/>
<event type="java" path="org.apache.ofbiz.content.data.DataEvents" invoke="serveObjectData"/>
<response name="success" type="none"/>
<response name="error" type="view" value="error"/>
<response name="io-error" type="none"/>
</request-map>
- -->
+
<request-map uri="showShoppingList">
<security https="false" auth="false"/>
<response name="success" type="view" value="showShoppingList" save-current-view="true"/>
Locked
