svn commit: r1737441 - in /ofbiz/branches/release15.12: ./ applications/order/src/org/ofb
Locked
svn commit: r1737441 - in /ofbiz/branches/release15.12: ./ applications/order/src/org/ofb
 
|
Author: jleroux
Date: Fri Apr 1 20:27:58 2016 New Revision: 1737441 URL: http://svn.apache.org/viewvc?rev=1737441&view=rev Log: "Applied fix from trunk for revision: 1737440" ------------------------------------------------------------------------ r1737440 | jleroux | 2016-04-01 22:27:13 +0200 (ven. 01 avr. 2016) | 11 lignes Fixes a possible security issue reported by Pascal Proulx at https://issues.apache.org/jira/browse/OFBIZ-6973 : "Flaw in content wrapper cache handling with encoderType" In ProductContentWrapper#getProductContentAsText and all similar content wrappers using a cache, the cacheKey does not include the new encoderType: String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId"); This makes it possible for subsequent calls on the same wrapper using different encoderTypes to return content having the wrong encoding and create potential security flaws. The key should include the encoderType: String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId") + SEPARATOR + encoderType; jleroux: I fixed all possible such occurrences (ie when encoderType is used) ------------------------------------------------------------------------ Modified: ofbiz/branches/release15.12/ (props changed) ofbiz/branches/release15.12/applications/order/src/org/ofbiz/order/order/OrderContentWrapper.java ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/category/CategoryContentWrapper.java ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/config/ProductConfigItemContentWrapper.java ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductContentWrapper.java ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductPromoContentWrapper.java Propchange: ofbiz/branches/release15.12/ ------------------------------------------------------------------------------ --- svn:mergeinfo (original) +++ svn:mergeinfo Fri Apr 1 20:27:58 2016 @@ -9,4 +9,4 @@ /ofbiz/branches/json-integration-refactoring:1634077-1635900 /ofbiz/branches/multitenant20100310:921280-927264 /ofbiz/branches/release13.07:1547657 -/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1737156 +/ofbiz/trunk:1722712,1723007,1723248,1724402,1724411,1724566,1724689,1724763,1724916,1724918,1724925,1724930,1724940,1724943,1724946,1724951,1724957,1724975,1724978,1725006,1725217,1725257,1725561,1725574,1726388,1726486,1726493,1726828,1728398,1728411,1729005,1729078,1729609,1729809,1730035,1730456,1730735-1730736,1730747,1730758,1730882,1730889,1731382,1731396,1732454,1732570,1732721,1733951,1733956,1734246,1734269,1734276,1734912,1734918,1735244,1735385,1735398,1735569,1735731,1735734,1735750,1735753,1735756,1735759,1735773,1736083,1736087,1736272,1736434,1736628,1736851,1736854,1737156,1737440 Modified: ofbiz/branches/release15.12/applications/order/src/org/ofbiz/order/order/OrderContentWrapper.java URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/order/src/org/ofbiz/order/order/OrderContentWrapper.java?rev=1737441&r1=1737440&r2=1737441&view=diff ============================================================================== --- ofbiz/branches/release15.12/applications/order/src/org/ofbiz/order/order/OrderContentWrapper.java (original) +++ ofbiz/branches/release15.12/applications/order/src/org/ofbiz/order/order/OrderContentWrapper.java Fri Apr 1 20:27:58 2016 @@ -98,7 +98,7 @@ public class OrderContentWrapper impleme String orderItemSeqId = (order.getEntityName().equals("OrderItem")? order.getString("orderItemSeqId"): "_NA_"); - String cacheKey = orderContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + order.get("orderId") + SEPARATOR + orderItemSeqId; + String cacheKey = orderContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + order.get("orderId") + SEPARATOR + orderItemSeqId + SEPARATOR + encoderType; try { String cachedValue = orderContentCache.get(cacheKey); if (cachedValue != null) { Modified: ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/category/CategoryContentWrapper.java URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/category/CategoryContentWrapper.java?rev=1737441&r1=1737440&r2=1737441&view=diff ============================================================================== --- ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/category/CategoryContentWrapper.java (original) +++ ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/category/CategoryContentWrapper.java Fri Apr 1 20:27:58 2016 @@ -97,7 +97,7 @@ public class CategoryContentWrapper impl public static String getProductCategoryContentAsText(GenericValue productCategory, String prodCatContentTypeId, Locale locale, String mimeTypeId, Delegator delegator, LocalDispatcher dispatcher, String encoderType) { String candidateFieldName = ModelUtil.dbNameToVarName(prodCatContentTypeId); UtilCodec.SimpleEncoder encoder = UtilCodec.getEncoder(encoderType); - String cacheKey = prodCatContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productCategory.get("productCategoryId"); + String cacheKey = prodCatContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productCategory.get("productCategoryId") + SEPARATOR + encoderType; try { String cachedValue = categoryContentCache.get(cacheKey); if (cachedValue != null) { Modified: ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/config/ProductConfigItemContentWrapper.java URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/config/ProductConfigItemContentWrapper.java?rev=1737441&r1=1737440&r2=1737441&view=diff ============================================================================== --- ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/config/ProductConfigItemContentWrapper.java (original) +++ ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/config/ProductConfigItemContentWrapper.java Fri Apr 1 20:27:58 2016 @@ -120,7 +120,7 @@ public class ProductConfigItemContentWra public static String getProductConfigItemContentAsText(GenericValue productConfigItem, String confItemContentTypeId, Locale locale, String mimeTypeId, Delegator delegator, LocalDispatcher dispatcher, String encoderType) { UtilCodec.SimpleEncoder encoder = UtilCodec.getEncoder(encoderType); String candidateFieldName = ModelUtil.dbNameToVarName(confItemContentTypeId); - String cacheKey = confItemContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productConfigItem.get("configItemId"); + String cacheKey = confItemContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productConfigItem.get("configItemId") + SEPARATOR + encoderType; try { String cachedValue = configItemContentCache.get(cacheKey); if (cachedValue != null) { Modified: ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductContentWrapper.java URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductContentWrapper.java?rev=1737441&r1=1737440&r2=1737441&view=diff ============================================================================== --- ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductContentWrapper.java (original) +++ ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductContentWrapper.java Fri Apr 1 20:27:58 2016 @@ -109,7 +109,7 @@ public class ProductContentWrapper imple /* caching: there is one cache created, "product.content" Each product's content is cached with a key of * contentTypeId::locale::mimeType::productId, or whatever the SEPARATOR is defined above to be. */ - String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId"); + String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId") + SEPARATOR + encoderType; try { String cachedValue = productContentCache.get(cacheKey); if (cachedValue != null) { Modified: ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductPromoContentWrapper.java URL: http://svn.apache.org/viewvc/ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductPromoContentWrapper.java?rev=1737441&r1=1737440&r2=1737441&view=diff ============================================================================== --- ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductPromoContentWrapper.java (original) +++ ofbiz/branches/release15.12/applications/product/src/org/ofbiz/product/product/ProductPromoContentWrapper.java Fri Apr 1 20:27:58 2016 @@ -114,7 +114,7 @@ public class ProductPromoContentWrapper /* caching: there is one cache created, "product.promo.content" Each productPromo's content is cached with a key of * contentTypeId::locale::mimeType::productPromoId, or whatever the SEPARATOR is defined above to be. */ - String cacheKey = productPromoContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productPromo.get("productPromoId"); + String cacheKey = productPromoContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + productPromo.get("productPromoId") + SEPARATOR + encoderType; try { String cachedValue = productPromoContentCache.get(cacheKey); if (cachedValue != null) { |
«
Return to OFBiz - Commits
|
1 view|%1 views
| Free forum by Nabble | Edit this page |