search

enonic / xp

Enonic XP
https://enonic.com
GNU General Public License v3.0
201 stars 34 forks source link

read and write exports to/from exports folder only #8863

Closed rymsha closed 3 years ago

rymsha commented 3 years ago

In unfortune situations XP can override some critical files if exports write is not restricted to "exports" folder.

Reading from "any" could be used maliciously.

rymsha commented 3 years ago

~This may end up being too strict without https://github.com/enonic/xp/issues/7654~

rymsha commented 3 years ago

in JS API it is only possible to specify export name (in exports folder) Java API still supports full path - for backwards compatibility