struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WW-4090) Remote code execution via wildcard matching and double evaluation of OGNL expression
Date Thu, 06 Jun 2013 05:30:22 GMT

    [ https://issues.apache.org/jira/browse/WW-4090?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13676708#comment-13676708
] 

ASF subversion and git services commented on WW-4090:
-----------------------------------------------------

Commit 1490149 from [~lukaszlenart]
[ https://svn.apache.org/r1490149 ]

Merged from STRUTS_2_3_14_2_X
WW-4090 Itroduces actions names' whitelisting [from revision 1488895]
WW-4090 Removes double evaluation of parsed expression [from revision 1488897]
WW-4090 Add some logging [from revision 1488899]
WW-4090 Uses warn level instead of debug [from revision 1488900]
                
> Remote code execution via wildcard matching and double evaluation of OGNL expression
> ------------------------------------------------------------------------------------
>
>                 Key: WW-4090
>                 URL: https://issues.apache.org/jira/browse/WW-4090
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core Actions, Expression Language
>    Affects Versions: 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.8, 2.1.8.1,
2.2.1, 2.2.1.1, 2.2.3, 2.2.3.1, 2.3.1, 2.3.1.1, 2.3.1.2, 2.3.3, 2.3.4, 2.3.4.1, 2.3.7, 2.3.8,
2.3.12, 2.3.14, 2.3.14.1, 2.3.14.2
>            Reporter: Lukasz Lenart
>            Assignee: Lukasz Lenart
>            Priority: Blocker
>             Fix For: 2.3.14.3
>
>
> See http://struts.apache.org/development/2.x/docs/s2-015.html for more details

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message