CVE-2022-39208: Files or Directories Accessible to External Parties (CWE-552)
value: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This file disclosure vulnerability can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data. This issue has been resolved in version 7.3.0 and users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 7.5
Published: 2022-09-13T19:15Z
Repository: https://github.com/theonedev/onedev
Language: XML
Files changed: pom.xml, server-core/pom.xml, server-core/src/main/java/io/onedev/server/maintenance/Upgrade.java, server-core/src/main/java/io/onedev/server/web/avatar/DefaultAvatarManager.java, server-core/src/main/java/io/onedev/server/web/component/brandlogo/BrandLogoPanel.java, server-core/src/main/java/io/onedev/server/web/page/admin/brandingsetting/BrandingSettingPage.java, server-plugin/pom.xml, server-plugin/server-plugin-archetype/pom.xml, server-plugin/server-plugin-authenticator-ldap/pom.xml, server-plugin/server-plugin-buildspec-gradle/pom.xml, server-plugin/server-plugin-buildspec-maven/pom.xml, server-plugin/server-plugin-buildspec-node/pom.xml, server-plugin/server-plugin-executor-kubernetes/pom.xml, server-plugin/server-plugin-executor-remotedocker/pom.xml, server-plugin/server-plugin-executor-remoteshell/pom.xml, server-plugin/server-plugin-executor-serverdocker/pom.xml, server-plugin/server-plugin-executor-servershell/pom.xml, server-plugin/server-plugin-import-bitbucketcloud/pom.xml, server-plugin/server-plugin-import-gitea/pom.xml, server-plugin/server-plugin-import-github/pom.xml, server-plugin/server-plugin-import-gitlab/pom.xml, server-plugin/server-plugin-import-jiracloud/pom.xml, server-plugin/server-plugin-import-youtrack/pom.xml, server-plugin/server-plugin-report-checkstyle/pom.xml, server-plugin/server-plugin-report-clover/pom.xml, server-plugin/server-plugin-report-coverage/pom.xml, server-plugin/server-plugin-report-cpd/pom.xml, server-plugin/server-plugin-report-jacoco/pom.xml, server-plugin/server-plugin-report-jest/pom.xml, server-plugin/server-plugin-report-junit/pom.xml, server-plugin/server-plugin-report-markdown/pom.xml, server-plugin/server-plugin-report-pmd/pom.xml, server-plugin/server-plugin-report-problem/pom.xml, server-plugin/server-plugin-report-spotbugs/pom.xml, server-plugin/server-plugin-report-unittest/pom.xml, server-plugin/server-plugin-sso-discord/pom.xml, server-plugin/server-plugin-sso-openid/pom.xml, server-product/pom.xml, server-product/src/main/java/io/onedev/server/product/ProductServletConfigurator.java
Commit date: 2022-05-30 20:58:18 +0800
Commit message: Fix security vulnerability issue regarding site/* access

Diff: diff --git a/pom.xml b/pom.xml
index 7ffeadd0269..76468b4dbe5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,11 +7,11 @@
 		<groupId>io.onedev</groupId>
 		<artifactId>parent</artifactId>
 		<version>1.0.5</version>
 	</parent>
 	<artifactId>server</artifactId>
-	<version>7.2.9</version>
+	<version>7.3.0</version>
 	<packaging>pom</packaging>
 	<build>
 		<finalName>${project.groupId}.${project.artifactId}-${project.version}</finalName>
 		<pluginManagement>
 			<plugins>
diff --git a/server-core/pom.xml b/server-core/pom.xml
index 21553c19294..b8de22e95fd 100644
--- a/server-core/pom.xml
+++ b/server-core/pom.xml
@@ -5,11 +5,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-core</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<build>
 		<plugins>
 			<plugin>
 				<groupId>org.antlr</groupId>
diff --git a/server-core/src/main/java/io/onedev/server/maintenance/Upgrade.java b/server-core/src/main/java/io/onedev/server/maintenance/Upgrade.java
index 6b1d2acff29..561ba3b819d 100644
--- a/server-core/src/main/java/io/onedev/server/maintenance/Upgrade.java
+++ b/server-core/src/main/java/io/onedev/server/maintenance/Upgrade.java
@@ -485,21 +485,52 @@ public class Upgrade extends DefaultPersistManager {
 		cleanAndCopy(new File(Bootstrap.installDir, "agent"), new File(upgradeDir, "agent"));
 		if (new File(upgradeDir, "boot/system.classpath").exists())
 			FileUtils.deleteFile(new File(upgradeDir, "boot/system.classpath"));
 		
 		cleanAndCopy(Bootstrap.getLibDir(), new File(upgradeDir, "lib"));
-		
-		for (File file: new File(Bootstrap.getSiteDir(), "avatars").listFiles()) {
+
+		FileUtils.createDir(new File(upgradeDir, "site/assets"));
+		if (new File(upgradeDir, "site/robots.txt").exists()) {
+			try {
+				FileUtils.copyFile(
+						new File(upgradeDir, "site/robots.txt"), 
+						new File(upgradeDir, "site/assets/robots.txt"));
+				FileUtils.deleteFile(new File(upgradeDir, "site/robots.txt"));
+			} catch (IOException e) {
+				throw new RuntimeException(e);
+			}
+		}
+		if (new File(upgradeDir, "site/logo.png").exists()) {
+			try {
+				FileUtils.copyFile(
+						new File(upgradeDir, "site/logo.png"), 
+						new File(upgradeDir, "site/assets/logo.png"));
+				FileUtils.deleteFile(new File(upgradeDir, "site/logo.png"));
+			} catch (IOException e) {
+				throw new RuntimeException(e);
+			}
+		}
+		if (new File(upgradeDir, "site/avatars").exists()) {
+			try {
+				FileUtils.copyDirectory(
+						new File(upgradeDir, "site/avatars"), 
+						new File(upgradeDir, "site/assets/avatars"));
+				FileUtils.deleteDir(new File(upgradeDir, "site/avatars"));
+			} catch (IOException e) {
+				throw new RuntimeException(e);
+			}
+		}
+		for (File file: new File(Bootstrap.getSiteDir(), "assets/avatars").listFiles()) {
 			if (file.isFile()) {
 				try {
-					FileUtils.copyFileToDirectory(file, new File(upgradeDir, "site/avatars"));
+					FileUtils.copyFileToDirectory(file, new File(upgradeDir, "site/assets/avatars"));
 				} catch (IOException e) {
 					throw new RuntimeException(e);
 				}
 			}
 		}
-		File uploadedDir = new File(upgradeDir, "site/avatars/uploaded");
+		File uploadedDir = new File(upgradeDir, "site/assets/avatars/uploaded");
 		File userUploadsDir = new File(uploadedDir, "users"); 
 		if (uploadedDir.exists() && !userUploadsDir.exists()) {
 			FileUtils.createDir(userUploadsDir);
 			for (File file: uploadedDir.listFiles()) {
 				if (file.isFile()) {
diff --git a/server-core/src/main/java/io/onedev/server/web/avatar/DefaultAvatarManager.java b/server-core/src/main/java/io/onedev/server/web/avatar/DefaultAvatarManager.java
index 89bb7ba21d9..4b53d39f023 100644
--- a/server-core/src/main/java/io/onedev/server/web/avatar/DefaultAvatarManager.java
+++ b/server-core/src/main/java/io/onedev/server/web/avatar/DefaultAvatarManager.java
@@ -91,11 +91,11 @@ public class DefaultAvatarManager implements AvatarManager {
 		if (StringUtils.isBlank(primaryName))
 			primaryName = "?";
 		if (StringUtils.isBlank(secondaryName))
 			secondaryName = primaryName;
 		
-		File avatarFile = new File(Bootstrap.getSiteDir(), "avatars/generated/" + encoded + ".png");
+		File avatarFile = new File(Bootstrap.getSiteDir(), "assets/avatars/generated/" + encoded + ".png");
 		if (!avatarFile.exists()) {
 			Lock avatarLock = LockUtils.getLock("generated-avatar:" + encoded);
 			avatarLock.lock();
 			try {
 				String letters = getLetter(primaryName);
@@ -127,11 +127,11 @@ public class DefaultAvatarManager implements AvatarManager {
 		return sb.toString();
 	}
 	
 	@Override
 	public File getUploaded(User user) {
-		return new File(Bootstrap.getSiteDir(), "avatars/uploaded/users/" + user.getId() + ".jpg");
+		return new File(Bootstrap.getSiteDir(), "assets/avatars/uploaded/users/" + user.getId() + ".jpg");
 	}
 
 	@Sessional
 	@Override
 	public void useAvatar(User user, String avatarData) {
@@ -168,11 +168,11 @@ public class DefaultAvatarManager implements AvatarManager {
 		}
 	}
 
 	@Override
 	public File getUploaded(Long projectId) {
-		return new File(Bootstrap.getSiteDir(), "avatars/uploaded/projects/" + projectId + ".jpg");
+		return new File(Bootstrap.getSiteDir(), "assets/avatars/uploaded/projects/" + projectId + ".jpg");
 	}
 
 	@Override
 	public void copyAvatar(Project from, Project to) {
 		Lock avatarLock = LockUtils.getLock("uploaded-project-avatar:" + from.getId());
diff --git a/server-core/src/main/java/io/onedev/server/web/component/brandlogo/BrandLogoPanel.java b/server-core/src/main/java/io/onedev/server/web/component/brandlogo/BrandLogoPanel.java
index b62fbeb492e..bbe13aa168c 100644
--- a/server-core/src/main/java/io/onedev/server/web/component/brandlogo/BrandLogoPanel.java
+++ b/server-core/src/main/java/io/onedev/server/web/component/brandlogo/BrandLogoPanel.java
@@ -16,11 +16,11 @@ public class BrandLogoPanel extends Panel {
 	public BrandLogoPanel(String id) {
 		super(id);
 	}
 
 	private File getCustomLogoFile() {
-		return new File(Bootstrap.getSiteDir(), "logo.png");
+		return new File(Bootstrap.getSiteDir(), "assets/logo.png");
 	}
 	
 	@Override
 	protected void onInitialize() {
 		super.onInitialize();
diff --git a/server-core/src/main/java/io/onedev/server/web/page/admin/brandingsetting/BrandingSettingPage.java b/server-core/src/main/java/io/onedev/server/web/page/admin/brandingsetting/BrandingSettingPage.java
index 2ee3609aa73..1140346da72 100644
--- a/server-core/src/main/java/io/onedev/server/web/page/admin/brandingsetting/BrandingSettingPage.java
+++ b/server-core/src/main/java/io/onedev/server/web/page/admin/brandingsetting/BrandingSettingPage.java
@@ -31,11 +31,11 @@ public class BrandingSettingPage extends AdministrationPage {
 	public BrandingSettingPage(PageParameters params) {
 		super(params);
 	}
 	
 	private File getLogoFile() {
-		return new File(Bootstrap.getSiteDir(), "logo.png");
+		return new File(Bootstrap.getSiteDir(), "assets/logo.png");
 	}
 
 	@Override
 	protected void onInitialize() {
 		super.onInitialize();
diff --git a/server-plugin/pom.xml b/server-plugin/pom.xml
index c129970758c..bc0397ec1da 100644
--- a/server-plugin/pom.xml
+++ b/server-plugin/pom.xml
@@ -4,11 +4,11 @@
 	<artifactId>server-plugin</artifactId>
 	<packaging>pom</packaging>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-core</artifactId>
diff --git a/server-plugin/server-plugin-archetype/pom.xml b/server-plugin/server-plugin-archetype/pom.xml
index 67bc2989ab9..23f8bcd253b 100644
--- a/server-plugin/server-plugin-archetype/pom.xml
+++ b/server-plugin/server-plugin-archetype/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-archetype</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<build>
 		<resources>
 		  <resource>
 			<directory>src/main/resources</directory>
diff --git a/server-plugin/server-plugin-authenticator-ldap/pom.xml b/server-plugin/server-plugin-authenticator-ldap/pom.xml
index ab645b15179..122658b81e0 100644
--- a/server-plugin/server-plugin-authenticator-ldap/pom.xml
+++ b/server-plugin/server-plugin-authenticator-ldap/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-authenticator-ldap</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.authenticator.ldap.LdapModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-buildspec-gradle/pom.xml b/server-plugin/server-plugin-buildspec-gradle/pom.xml
index c0f12764b08..c8d965f66be 100644
--- a/server-plugin/server-plugin-buildspec-gradle/pom.xml
+++ b/server-plugin/server-plugin-buildspec-gradle/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-gradle</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.buildspec.gradle.GradleModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-buildspec-maven/pom.xml b/server-plugin/server-plugin-buildspec-maven/pom.xml
index 49dd5eaa280..46330c303a4 100644
--- a/server-plugin/server-plugin-buildspec-maven/pom.xml
+++ b/server-plugin/server-plugin-buildspec-maven/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-maven</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.buildspec.maven.MavenModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-buildspec-node/pom.xml b/server-plugin/server-plugin-buildspec-node/pom.xml
index 7563567833a..3f496589c21 100644
--- a/server-plugin/server-plugin-buildspec-node/pom.xml
+++ b/server-plugin/server-plugin-buildspec-node/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-node</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.buildspec.node.NodePluginModule</moduleClass>
 	</properties>
 
diff --git a/server-plugin/server-plugin-executor-kubernetes/pom.xml b/server-plugin/server-plugin-executor-kubernetes/pom.xml
index 0a738453ef2..46adda523a3 100644
--- a/server-plugin/server-plugin-executor-kubernetes/pom.xml
+++ b/server-plugin/server-plugin-executor-kubernetes/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-kubernetes</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.executor.kubernetes.KubernetesModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-executor-remotedocker/pom.xml b/server-plugin/server-plugin-executor-remotedocker/pom.xml
index 30816528580..b472eb5d0de 100644
--- a/server-plugin/server-plugin-executor-remotedocker/pom.xml
+++ b/server-plugin/server-plugin-executor-remotedocker/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-remotedocker</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-executor-serverdocker</artifactId>
diff --git a/server-plugin/server-plugin-executor-remoteshell/pom.xml b/server-plugin/server-plugin-executor-remoteshell/pom.xml
index a352a0b645f..8a8f2589f28 100644
--- a/server-plugin/server-plugin-executor-remoteshell/pom.xml
+++ b/server-plugin/server-plugin-executor-remoteshell/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-remoteshell</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-executor-servershell</artifactId>
diff --git a/server-plugin/server-plugin-executor-serverdocker/pom.xml b/server-plugin/server-plugin-executor-serverdocker/pom.xml
index 6f6ba9a469d..ee376ee88e5 100644
--- a/server-plugin/server-plugin-executor-serverdocker/pom.xml
+++ b/server-plugin/server-plugin-executor-serverdocker/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-serverdocker</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.executor.serverdocker.ServerDockerModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-executor-servershell/pom.xml b/server-plugin/server-plugin-executor-servershell/pom.xml
index ddf186f641f..3a37c5f4663 100644
--- a/server-plugin/server-plugin-executor-servershell/pom.xml
+++ b/server-plugin/server-plugin-executor-servershell/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-servershell</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.executor.servershell.ServerShellModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-bitbucketcloud/pom.xml b/server-plugin/server-plugin-import-bitbucketcloud/pom.xml
index 27233b5210d..d0aeb6219ba 100644
--- a/server-plugin/server-plugin-import-bitbucketcloud/pom.xml
+++ b/server-plugin/server-plugin-import-bitbucketcloud/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-bitbucketcloud</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.bitbucketcloud.BitbucketPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-gitea/pom.xml b/server-plugin/server-plugin-import-gitea/pom.xml
index 615dd9a16c7..2d31d28fdc7 100644
--- a/server-plugin/server-plugin-import-gitea/pom.xml
+++ b/server-plugin/server-plugin-import-gitea/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-gitea</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.gitea.GiteaPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-github/pom.xml b/server-plugin/server-plugin-import-github/pom.xml
index beb9fc646cd..658134b1fb9 100644
--- a/server-plugin/server-plugin-import-github/pom.xml
+++ b/server-plugin/server-plugin-import-github/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-github</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.github.GitHubPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-gitlab/pom.xml b/server-plugin/server-plugin-import-gitlab/pom.xml
index c52f3a1c449..84b61bac90d 100644
--- a/server-plugin/server-plugin-import-gitlab/pom.xml
+++ b/server-plugin/server-plugin-import-gitlab/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-gitlab</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.gitlab.GitLabPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-jiracloud/pom.xml b/server-plugin/server-plugin-import-jiracloud/pom.xml
index 1989fd8ab5f..0c7b73a7cfa 100644
--- a/server-plugin/server-plugin-import-jiracloud/pom.xml
+++ b/server-plugin/server-plugin-import-jiracloud/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-jiracloud</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.jiracloud.JiraPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-import-youtrack/pom.xml b/server-plugin/server-plugin-import-youtrack/pom.xml
index 7de73694d89..e5f492cc241 100644
--- a/server-plugin/server-plugin-import-youtrack/pom.xml
+++ b/server-plugin/server-plugin-import-youtrack/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-import-youtrack</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.imports.youtrack.YouTrackPluginModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-report-checkstyle/pom.xml b/server-plugin/server-plugin-report-checkstyle/pom.xml
index 1887a67b6de..e45ba20a673 100644
--- a/server-plugin/server-plugin-report-checkstyle/pom.xml
+++ b/server-plugin/server-plugin-report-checkstyle/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-checkstyle</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-problem</artifactId>
diff --git a/server-plugin/server-plugin-report-clover/pom.xml b/server-plugin/server-plugin-report-clover/pom.xml
index 714f0936270..e008643ec4f 100644
--- a/server-plugin/server-plugin-report-clover/pom.xml
+++ b/server-plugin/server-plugin-report-clover/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-clover</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-coverage</artifactId>
diff --git a/server-plugin/server-plugin-report-coverage/pom.xml b/server-plugin/server-plugin-report-coverage/pom.xml
index 4e1dcb71a61..5c784bbe749 100644
--- a/server-plugin/server-plugin-report-coverage/pom.xml
+++ b/server-plugin/server-plugin-report-coverage/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-coverage</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.coverage.CoverageReportModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-report-cpd/pom.xml b/server-plugin/server-plugin-report-cpd/pom.xml
index d1a6b58f40b..ecace1be7ca 100644
--- a/server-plugin/server-plugin-report-cpd/pom.xml
+++ b/server-plugin/server-plugin-report-cpd/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-cpd</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-problem</artifactId>
diff --git a/server-plugin/server-plugin-report-jacoco/pom.xml b/server-plugin/server-plugin-report-jacoco/pom.xml
index 7168ef266e2..66689cc4ce1 100644
--- a/server-plugin/server-plugin-report-jacoco/pom.xml
+++ b/server-plugin/server-plugin-report-jacoco/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-jacoco</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-coverage</artifactId>
diff --git a/server-plugin/server-plugin-report-jest/pom.xml b/server-plugin/server-plugin-report-jest/pom.xml
index 00b3e0606ce..12138592830 100644
--- a/server-plugin/server-plugin-report-jest/pom.xml
+++ b/server-plugin/server-plugin-report-jest/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-jest</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-unittest</artifactId>
diff --git a/server-plugin/server-plugin-report-junit/pom.xml b/server-plugin/server-plugin-report-junit/pom.xml
index 4dd49999159..8e5575073c2 100644
--- a/server-plugin/server-plugin-report-junit/pom.xml
+++ b/server-plugin/server-plugin-report-junit/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-junit</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-unittest</artifactId>
diff --git a/server-plugin/server-plugin-report-markdown/pom.xml b/server-plugin/server-plugin-report-markdown/pom.xml
index cc9c50a4372..5a96657e1b3 100644
--- a/server-plugin/server-plugin-report-markdown/pom.xml
+++ b/server-plugin/server-plugin-report-markdown/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-markdown</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.markdown.MarkdownReportModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-report-pmd/pom.xml b/server-plugin/server-plugin-report-pmd/pom.xml
index 726d5d095a4..a52d024339f 100644
--- a/server-plugin/server-plugin-report-pmd/pom.xml
+++ b/server-plugin/server-plugin-report-pmd/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-pmd</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-problem</artifactId>
diff --git a/server-plugin/server-plugin-report-problem/pom.xml b/server-plugin/server-plugin-report-problem/pom.xml
index d3436fccce7..aac302355b6 100644
--- a/server-plugin/server-plugin-report-problem/pom.xml
+++ b/server-plugin/server-plugin-report-problem/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-problem</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.problem.ProblemReportModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-report-spotbugs/pom.xml b/server-plugin/server-plugin-report-spotbugs/pom.xml
index 42a45ec7bd6..3bd62fbfd8e 100644
--- a/server-plugin/server-plugin-report-spotbugs/pom.xml
+++ b/server-plugin/server-plugin-report-spotbugs/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-spotbugs</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-problem</artifactId>
diff --git a/server-plugin/server-plugin-report-unittest/pom.xml b/server-plugin/server-plugin-report-unittest/pom.xml
index e9ce35777ee..9591fd3ca44 100644
--- a/server-plugin/server-plugin-report-unittest/pom.xml
+++ b/server-plugin/server-plugin-report-unittest/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-unittest</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.unittest.UnitTestReportModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-sso-discord/pom.xml b/server-plugin/server-plugin-sso-discord/pom.xml
index 0dc9cb1c370..7f2ff212a78 100644
--- a/server-plugin/server-plugin-sso-discord/pom.xml
+++ b/server-plugin/server-plugin-sso-discord/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-sso-discord</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.sso.discord.DiscordModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-sso-openid/pom.xml b/server-plugin/server-plugin-sso-openid/pom.xml
index f0e4bbd7894..c7c4231b780 100644
--- a/server-plugin/server-plugin-sso-openid/pom.xml
+++ b/server-plugin/server-plugin-sso-openid/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-sso-openid</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>com.nimbusds</groupId>
 			<artifactId>oauth2-oidc-sdk</artifactId>
diff --git a/server-product/pom.xml b/server-product/pom.xml
index 61d68069a5b..d7a24c89144 100644
--- a/server-product/pom.xml
+++ b/server-product/pom.xml
@@ -5,11 +5,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-product</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>7.2.9</version>
+		<version>7.3.0</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-core</artifactId>
diff --git a/server-product/src/main/java/io/onedev/server/product/ProductServletConfigurator.java b/server-product/src/main/java/io/onedev/server/product/ProductServletConfigurator.java
index 6dc591896ad..6072bfa4280 100644
--- a/server-product/src/main/java/io/onedev/server/product/ProductServletConfigurator.java
+++ b/server-product/src/main/java/io/onedev/server/product/ProductServletConfigurator.java
@@ -1,7 +1,8 @@
 package io.onedev.server.product;
 
+import java.io.File;
 import java.util.EnumSet;
 
 import javax.inject.Inject;
 import javax.servlet.DispatcherType;
 import javax.servlet.http.HttpSessionEvent;
@@ -117,12 +118,14 @@ public class ProductServletConfigurator implements ServletConfigurator {
 		
 		/*
 		 * Configure a servlet to serve contents under site folder. Site folder can be used 
 		 * to hold site specific web assets.   
 		 */
-		ServletHolder fileServletHolder = new ServletHolder(new FileAssetServlet(Bootstrap.getSiteDir()));
+		File assetsDir = new File(Bootstrap.getSiteDir(), "assets");
+		ServletHolder fileServletHolder = new ServletHolder(new FileAssetServlet(assetsDir));
 		context.addServlet(fileServletHolder, "/site/*");
+		
 		context.addServlet(fileServletHolder, "/robots.txt");
 		
 		context.addServlet(new ServletHolder(jerseyServlet), "/api/*");	
 		context.addServlet(new ServletHolder(serverServlet), "/server");
 	}
diff --git a/server-product/system/site/avatars/onedev.png b/server-product/system/site/assets/avatars/onedev.png
similarity index 100%
rename from server-product/system/site/avatars/onedev.png
rename to server-product/system/site/assets/avatars/onedev.png
diff --git a/server-product/system/site/avatars/project.png b/server-product/system/site/assets/avatars/project.png
similarity index 100%
rename from server-product/system/site/avatars/project.png
rename to server-product/system/site/assets/avatars/project.png
diff --git a/server-product/system/site/avatars/user.png b/server-product/system/site/assets/avatars/user.png
similarity index 100%
rename from server-product/system/site/avatars/user.png
rename to server-product/system/site/assets/avatars/user.png
diff --git a/server-product/system/site/robots.txt b/server-product/system/site/assets/robots.txt
similarity index 100%
rename from server-product/system/site/robots.txt
rename to server-product/system/site/assets/robots.txt

Vulnerable code: 	<version>7.2.9</version>
		<version>7.2.9</version>
		
		for (File file: new File(Bootstrap.getSiteDir(), "avatars").listFiles()) {
					FileUtils.copyFileToDirectory(file, new File(upgradeDir, "site/avatars"));
		File uploadedDir = new File(upgradeDir, "site/avatars/uploaded");
		File avatarFile = new File(Bootstrap.getSiteDir(), "avatars/generated/" + encoded + ".png");
		return new File(Bootstrap.getSiteDir(), "avatars/uploaded/users/" + user.getId() + ".jpg");
		return new File(Bootstrap.getSiteDir(), "avatars/uploaded/projects/" + projectId + ".jpg");
		return new File(Bootstrap.getSiteDir(), "logo.png");
		return new File(Bootstrap.getSiteDir(), "logo.png");
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		<version>7.2.9</version>
		ServletHolder fileServletHolder = new ServletHolder(new FileAssetServlet(Bootstrap.getSiteDir()));
Fixed code: 	<version>7.3.0</version>
		<version>7.3.0</version>

		FileUtils.createDir(new File(upgradeDir, "site/assets"));
		if (new File(upgradeDir, "site/robots.txt").exists()) {
			try {
				FileUtils.copyFile(
						new File(upgradeDir, "site/robots.txt"), 
						new File(upgradeDir, "site/assets/robots.txt"));
				FileUtils.deleteFile(new File(upgradeDir, "site/robots.txt"));
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		}
		if (new File(upgradeDir, "site/logo.png").exists()) {
			try {
				FileUtils.copyFile(
						new File(upgradeDir, "site/logo.png"), 
						new File(upgradeDir, "site/assets/logo.png"));
				FileUtils.deleteFile(new File(upgradeDir, "site/logo.png"));
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		}
		if (new File(upgradeDir, "site/avatars").exists()) {
			try {
				FileUtils.copyDirectory(
						new File(upgradeDir, "site/avatars"), 
						new File(upgradeDir, "site/assets/avatars"));
				FileUtils.deleteDir(new File(upgradeDir, "site/avatars"));
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		}
		for (File file: new File(Bootstrap.getSiteDir(), "assets/avatars").listFiles()) {
					FileUtils.copyFileToDirectory(file, new File(upgradeDir, "site/assets/avatars"));
		File uploadedDir = new File(upgradeDir, "site/assets/avatars/uploaded");
		File avatarFile = new File(Bootstrap.getSiteDir(), "assets/avatars/generated/" + encoded + ".png");
		return new File(Bootstrap.getSiteDir(), "assets/avatars/uploaded/users/" + user.getId() + ".jpg");
		return new File(Bootstrap.getSiteDir(), "assets/avatars/uploaded/projects/" + projectId + ".jpg");
		return new File(Bootstrap.getSiteDir(), "assets/logo.png");
		return new File(Bootstrap.getSiteDir(), "assets/logo.png");
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
		<version>7.3.0</version>
import java.io.File;
		File assetsDir = new File(Bootstrap.getSiteDir(), "assets");
		ServletHolder fileServletHolder = new ServletHolder(new FileAssetServlet(assetsDir));