CVE-2022-29784: Insufficient Information (NVD-CWE-noinfo)
value: PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-06-03T21:15Z
Repository: https://github.com/sanluan/PublicCMS
Language: Java
Files changed: publiccms-parent/build.gradle, publiccms-parent/pom.xml, publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java, publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java, publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java
Commit date: 2022-04-22 19:14:05 +0800
Commit message: 安全漏洞修复 感谢 姜洋-长亭科技
Diff: diff --git "a/doc/PublicCMS V4.0 \344\272\214\346\254\241\345\274\200\345\217\221\346\211\213\345\206\214_\344\270\255\346\226\207.doc" "b/doc/PublicCMS V4.0 \344\272\214\346\254\241\345\274\200\345\217\221\346\211\213\345\206\214_\344\270\255\346\226\207.doc"
index e0b8ebde6..8b2c87fce 100644
Binary files "a/doc/PublicCMS V4.0 \344\272\214\346\254\241\345\274\200\345\217\221\346\211\213\345\206\214_\344\270\255\346\226\207.doc" and "b/doc/PublicCMS V4.0 \344\272\214\346\254\241\345\274\200\345\217\221\346\211\213\345\206\214_\344\270\255\346\226\207.doc" differ
diff --git a/publiccms-parent/build.gradle b/publiccms-parent/build.gradle
index 3538d782f..07d406329 100644
--- a/publiccms-parent/build.gradle
+++ b/publiccms-parent/build.gradle
@@ -21,11 +21,11 @@ subprojects {
     apply plugin: "java"
     apply plugin: 'idea'
     apply plugin: "eclipse-wtp"
 
     group = 'com.publiccms'
-    version = 'V4.0.202204.a'
+    version = 'V4.0.202204.b'
     
     test.enabled = false
     
     ext {
         // http://mvnrepository.com/artifact/org.springframework/spring-core
diff --git a/publiccms-parent/pom.xml b/publiccms-parent/pom.xml
index ddfb37154..7804ed475 100644
--- a/publiccms-parent/pom.xml
+++ b/publiccms-parent/pom.xml
@@ -20,11 +20,11 @@
         <java.version>1.8</java.version>
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.encoding>UTF-8</maven.compiler.encoding>
-        <version.publiccms>V4.0.202204.a</version.publiccms>
+        <version.publiccms>V4.0.202204.b</version.publiccms>
         <!-- http://mvnrepository.com/artifact/org.springframework/spring-core -->
         <!-- https://spring.io/projects/spring-framework -->
         <version.spring>5.3.19</version.spring>
         <!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-web -->
         <!-- https://spring.io/projects/spring-boot -->
diff --git a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java
index 2f22b3d21..e8cef172d 100644
--- a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java
+++ b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java
@@ -26,11 +26,11 @@ public class CmsVersion {
     }
     /**
      * @return revision
      */
     public static final String getRevision() {
-        return "a";
+        return "b";
     }
 
     /**
      * @return whether the authorization edition
      */
diff --git a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java
index 3dd0056fc..0dcd06e3f 100644
--- a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java
+++ b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java
@@ -48,9 +48,14 @@ public class SysConfigDataDirective extends AbstractTemplateDirective {
             }
             handler.put("map", map).render();
         }
     }
 
+    @Override
+    public boolean needAppToken() {
+        return true;
+    }
+
     @Autowired
     private SysConfigDataService service;
 
 }
diff --git a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java
index 319b04b02..03e9f0536 100644
--- a/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java
+++ b/publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java
@@ -43,9 +43,14 @@ public class SysDatasourceDirective extends AbstractTemplateDirective {
                 handler.put("map", map).render();
             }
         }
     }
 
+    @Override
+    public boolean needAppToken() {
+        return true;
+    }
+
     @Autowired
     private SysDatasourceService service;
 
 }

Vulnerable code:     version = 'V4.0.202204.a'
        <version.publiccms>V4.0.202204.a</version.publiccms>
        return "a";
Fixed code:     version = 'V4.0.202204.b'
        <version.publiccms>V4.0.202204.b</version.publiccms>
        return "b";
    @Override
    public boolean needAppToken() {
        return true;
    }

    @Override
    public boolean needAppToken() {
        return true;
    }