Loading...

velocity-dev@jakarta.apache.org

[Prev] Thread [Next]  |  [Prev] Date [Next]

[jira] [Commented] (VELTOOLS-150) VelocityLayoutServlet allows clients to specify "layout" without performing any security checks. Nathan Bubna (Commented) (JIRA) Thu Feb 02 07:07:17 2012

    [ 
https://issues.apache.org/jira/browse/VELTOOLS-150?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13189891#comment-13189891
 ] 

Nathan Bubna commented on VELTOOLS-150:
---------------------------------------

Agreed on all points.
                
> VelocityLayoutServlet allows clients to specify "layout" without performing 
> any security checks.
> ------------------------------------------------------------------------------------------------
>
>                 Key: VELTOOLS-150
>                 URL: https://issues.apache.org/jira/browse/VELTOOLS-150
>             Project: Velocity Tools
>          Issue Type: Bug
>          Components: VelocityView
>    Affects Versions: 1.4, 2.0
>         Environment: Velocity 1.7, Velocity Tools 2.0.
> Confirmed also affects Velocity 1.4, Velocity Tools 1.4.
>            Reporter: Christopher Schultz
>            Priority: Critical
>              Labels: security
>
> For reference:
> http://markmail.org/thread/43cz2dymzmxjjrq5

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: 
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]