/[Apache-SVN]

Revision 1758791

Jump to revision:
Author:	reschke
Date:	Thu Sep 1 14:51:07 2016 UTC (8 years, 3 months ago)
Changed paths:	6
Log Message:	JCR-4009: CSRF in Jackrabbit-Webdav (ported to 2.4) (CVE-2016-6801) CSRFUtil: properly parse content types (handle params, normalize, handle case differences also multiple field instances), handle missing content type header field, handle partial-URI in referer, DEBUG logging WebDAV servlet: disable bogus POST support Davex: include Referer header field in POST requests used for davex remoting

Changed paths

Path	Details
jackrabbit/branches/2.4/	modified , props changed
jackrabbit/branches/2.4/jackrabbit-spi2dav/src/main/java/org/apache/jackrabbit/spi2davex/PostMethod.java	modified , text changed
jackrabbit/branches/2.4/jackrabbit-webdav/src/main/java/org/apache/jackrabbit/webdav/DavResource.java	modified , text changed
jackrabbit/branches/2.4/jackrabbit-webdav/src/main/java/org/apache/jackrabbit/webdav/server/AbstractWebdavServlet.java	modified , text changed
jackrabbit/branches/2.4/jackrabbit-webdav/src/main/java/org/apache/jackrabbit/webdav/util/CSRFUtil.java	modified , text changed
jackrabbit/branches/2.4/jackrabbit-webdav/src/test/java/org/apache/jackrabbit/webdav/util/CSRFUtilTest.java	modified , text changed

infrastructure at apache.org	ViewVC Help
Powered by ViewVC 1.1.26