Clone Tools
  • last updated a few minutes ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Improved: Cannot find the declaration of element 'web-app' in version 3.0 files. (OFBIZ-6993)

I missed to backport changes web.xml (was OK in plugins)

  1. … 24 more files in changeset.
Fixed: Apache OFBiz unsafe deserialization of XMLRPC arguments (CVE-2020-9496)

(OFBIZ-11716)

Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using

authentication they are vulnerable to unsafe deserialization.

thanks: Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team

  1. … 2 more files in changeset.
Fixed: Apache OFBiz unsafe deserialization of XMLRPC arguments (CVE-2020-9496)

(OFBIZ-11716)

Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using

authentication they are vulnerable to unsafe deserialization.

thanks: Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team

  1. … 2 more files in changeset.
Fixed: Apache OFBiz unsafe deserialization of XMLRPC arguments (CVE-2020-9496)

(OFBIZ-11716)

Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using

authentication they are vulnerable to unsafe deserialization.

thanks: Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team

  1. … 2 more files in changeset.
reverted: CLONE - Use only HTTPS in OFBiz

(OFBIZ-11643)

Reverted, this needs more work

  1. … 2 more files in changeset.
Fixed: CLONE - Use only HTTPS in OFBiz

(OFBIZ-11643)

When doing OFBIZ-6849 I forgot to take care of the https attribute of the

security element used in controllers.

It's not used anymore since we used HTTPS everywhere but in request listed in

http.request-map.list property of url.properties. It's even enforced by HSTS for

requests that are not listed in this property.

This removes the https attribute and removes its usage in in controllers.

  1. … 2 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Fixed: Ensure that the SameSite attribute is set to 'strict' for all cookies.

(OFBIZ-11470)

As reported by OWASP ZAP:

A cookie has been set without the SameSite attribute, which means that the

cookie can be sent as a result of a 'cross-site' request. The SameSite attribute

is an effective counter measure to cross-site request forgery, cross-site script

inclusion, and timing attacks.

The solution was not obvious in OFBiz for 2 reasons:

1. There is no HttpServletResponse::setHeader. So we need to use a filter

(SameSiteFilter) and even that is not enough because of 2:

2. To prevent session fixation we force Tomcat to generates a new jsessionId,

ultimately put in cookie, in LoginWorker::login. So we need to add a call to

SameSiteFilter::addSameSiteCookieAttribute in

UtilHttp::setResponseBrowserDefaultSecurityHeaders.

  1. … 15 more files in changeset.
Improved: Implemented: Documented: Completed: Reverted: Fixed: Improved: no functional change (OFBIZ-) Explanation Thanks:

  1. … 40 more files in changeset.
Creates new POC-for-CSRF-Token-OFBIZ-11306 branch

To share with James and others and later when OK to create a PR

  1. … 40 more files in changeset.
Implemented: REST, adding segmented URI support for webtools/entitymaint (OFBIZ-11007)

After implemeted Rest mechanism on rev. 1868963 by Mathieu Lirzin,

I reviewed the rest url implemented by Artemiy Rozovyk for entitymaint in webtools.

With discussion with Mathieu and Leila, I selected this pattern :

entity/[cover]/{entityName}/{pkValues: .*}

and implemented like this :

entity/list -> list all entities

entity/find/Party -> search

entity/find/Party/Company -> displaying form for Party with id Company

entity/create/Party -> creation form for a Party

entity/edit/Party/Company/Company -> edit form for Party with id Company

entity/change/Party/Company -> call crud following given http method

entity/relations/Party -> View relation for Party

The old uris were currently kept and the oldest GenericWebEvent.updateGeneric() were updated to support rest method information.

Thanks Mathieu, Artemiy and Leila for their help to complete this improvement.

  1. … 12 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit 3075027df7c82bcb381810d9d438150ef696254f.

  1. … 24 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit a93b1fcb7859a754ba84b810c4736e7ef6778689.

  1. … 24 more files in changeset.
Revert "Improved: Update “web.xml” files version 3.0 → 4.0 (OFBIZ-6993)"

This reverts commit 226e901981b68941bbcf3e1025d2208061d28db6.

  1. … 24 more files in changeset.
Reverted: "Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)"

This reverts commit d1c037dca1ea14caf545c85c3741bb9af093f3c9.

  1. … 24 more files in changeset.
Improved: Update “web.xml” files version 3.0 → 4.0 (OFBIZ-6993)

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: Add XML declaration in “web.xml” files (OFBIZ-6993)

These declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: Add XML declaration in “web.xml” files (OFBIZ-6993)

These declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Fixed: add XML declaration in “web.xml” files (OFBIZ-6993)

these declarations avoid SAXParseException traceback when parsing web.xml

the first time in WebappUtil.parseWebXmlFile

  1. … 24 more files in changeset.
Reverted: JSON entity data import and export utility (OFBIZ-10966)

Implementation was not matching OFBiz code quality requirements.

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1867342 13f79535-47bb-0310-9956-ffa450edef68

  1. … 17 more files in changeset.
Implemented: JSON entity data import and export utility (OFBIZ-10966)

Currently, we support import/export entity data in XML format.

Nowadays JSON is widely used in industry, we can have support for JSON format

which looks quite similar to XML support.

Here is example of XML data and it's JSON version

<Party partyId="123456" partyTypeId="PERSON" statusId="PARTY_ENABLED"/>

{“Party”: {"partyId":"123456","partyTypeId":"PERSON","statusId":"PARTY_ENABLED”}}

Design Proposal

We can write entityImportJson and entityImportDirJson services for importing

JSON from screen and directory respectively.

And the entityExportAllJson service for exporting entity data in JSON.

Import Design

The import service will perform following operations:

1.) Validate the input JSON data

2.) On successful validation, convert JSON to OFBiz's entity model

(GenericValue)

3.) The GenericValue will be inserted in database by some handler class for e.g

we can write JsonDataHandler, it will convert given JSON to

List<GenericValue>, and finally write it to database

(Similar pattern is used in XML import).

Export Design

Based on existing XML pattern the writeXmlText method of GenericEntity class

write the exported data in XML format.

In the similar way, we can implement writeJsonText to export data in JSON format.

jleroux: I fixed 2 trivials things and at my request in last patch Jayansh added

"JSON Data Export All" and "JSON Data Import Dir

Thanks: Jayansh Shinde

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1862206 13f79535-47bb-0310-9956-ffa450edef68

  1. … 17 more files in changeset.
Improved: Improve error message page to support Theming (OFBIZ-10753)

When OFBiz raise an error, the framework use a jsp page to display it.

I improved the error page generation to support also ftl template rendering and by this way extend the theme engine to support to overide it

On controler.xml we can now use :

<errorpage>/error/error.jsp</errorpage>

or

<errorpage>component://common/webcommon/error/Error.ftl</errorpage> (default configuration)

On your theme you can add your own error page :

<template>

...

<template-file widget=menu location=component://common-theme/template/macro/HtmlMenuMacroLibrary.ftl/>

+ <template-file widget=error location=component://common-theme/template/ErrorPage.ftl/>

</template>

The component://common/webcommon/error/Error.ftl contains the logic theming connection and to simplify source code, all framework old error page (error.jsp) have been removed to centralize all on this new page.

Thanks to Marine Desmarchelier for the error page design

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1856175 13f79535-47bb-0310-9956-ffa450edef68

# Conflicts:

# framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlServlet.java

# themes/common/template/ErrorPage.ftl

  1. … 22 more files in changeset.
Improved: Improve error message page to support Theming (OFBIZ-10753)

When OFBiz raise an error, the framework use a jsp page to display it.

I improved the error page generation to support also ftl template rendering and by this way extend the theme engine to support to overide it

On controler.xml we can now use :

<errorpage>/error/error.jsp</errorpage>

or

<errorpage>component://common/webcommon/error/Error.ftl</errorpage> (default configuration)

On your theme you can add your own error page :

<template>

...

<template-file widget=menu location=component://common-theme/template/macro/HtmlMenuMacroLibrary.ftl/>

+ <template-file widget=error location=component://common-theme/template/ErrorPage.ftl/>

</template>

The component://common/webcommon/error/Error.ftl contains the logic theming connection and to simplify source code, all framework old error page (error.jsp) have been removed to centralize all on this new page.

Thanks to Marine Desmarchelier for the error page design

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1856175 13f79535-47bb-0310-9956-ffa450edef68

  1. … 23 more files in changeset.
Improved: Improve error message page to support Theming (OFBIZ-10753)

When OFBiz raise an error, the framework use a jsp page to display it.

I improved the error page generation to support also ftl template rendering and by this way extend the theme engine to support to overide it

On controler.xml we can now use :

<errorpage>/error/error.jsp</errorpage>

or

<errorpage>component://common/webcommon/error/Error.ftl</errorpage> (default configuration)

On your theme you can add your own error page :

<template>

...

<template-file widget=menu location=component://common-theme/template/macro/HtmlMenuMacroLibrary.ftl/>

+ <template-file widget=error location=component://common-theme/template/ErrorPage.ftl/>

</template>

The component://common/webcommon/error/Error.ftl contains the logic theming connection and to simplify source code, all framework old error page (error.jsp) have been removed to centralize all on this new page.

Thanks to Marine Desmarchelier for the error page design

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1856175 13f79535-47bb-0310-9956-ffa450edef68

  1. … 23 more files in changeset.
"Applied fix from trunk for revision: 1851068 " ------------------------------------------------------------------------ r1851068 | jleroux | 2019-01-11 17:12:01 +0100 (ven. 11 janv. 2019) | 12 lignes

Fixed: Add session tracking mode and make cookie secure

(OFBIZ-6655)

Following "Session timeout for webapps" discussion on dev ML

https://markmail.org/message/p6fbiojjrwb2ybxd

We decided to put back the session-timeout value in web.xml files and to remove

the line

session.setMaxInactiveInterval(60*60); //in seconds

from ControlEventListener.java

Thanks: Deepak Nigam for report and Girish Vasmatkar for discussion

------------------------------------------------------------------------

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/branches/release17.12@1851071 13f79535-47bb-0310-9956-ffa450edef68

  1. … 15 more files in changeset.
"Applied fix from trunk for revision: 1851068 " ------------------------------------------------------------------------ r1851068 | jleroux | 2019-01-11 17:12:01 +0100 (ven. 11 janv. 2019) | 12 lignes

Fixed: Add session tracking mode and make cookie secure

(OFBIZ-6655)

Following "Session timeout for webapps" discussion on dev ML

https://markmail.org/message/p6fbiojjrwb2ybxd

We decided to put back the session-timeout value in web.xml files and to remove

the line

session.setMaxInactiveInterval(60*60); //in seconds

from ControlEventListener.java

Thanks: Deepak Nigam for report and Girish Vasmatkar for discussion

------------------------------------------------------------------------

git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/branches/release18.12@1851070 13f79535-47bb-0310-9956-ffa450edef68

  1. … 15 more files in changeset.