Fix for Proxy URL parameter vulnerability for 13.09

Fix for a vulnerability where client could access localhost resources via proxy url.

Added a permissions file so that the urls that are permitted to be proxied can be controlled.  By default all accesses to localhost (server localhost) are denied.

Also any protected services (extractorapp, geonetwork, etc...) are denied because they must be accessed using the path proxy strategy this way the spring security can add extra authorization checks.
The old version sometimes causes the build to fail. This newer version has
some fixes that make it more robust. (As far as I can tell.)

Jesse


On Thu, Aug 21, 2014 at 10:18 AM, Pierre Mauduit <notifications@github.com>
wrote:

In pom.xml:

> @@ -52,7 +52,7 @@ new PostTreatment().run(this, log, ant, project.basedir, params.projectDir, serv
>         <plugin>
>           <groupId>pl.project13.maven</groupId>
>           <artifactId>git-commit-id-plugin</artifactId>
> -         <version>2.1.4</version>
> +         <version>2.1.10</version>


Out of curiosity, is it related to a bug at compilation ? (unable to find
some tags in git repository or so)


—
Reply to this email directly or view it on GitHub
<https://github.com/georchestra/georchestra/pull/743/files#r16525807>.