sheehan/grails-console — pull request #22 by dtanner (2014-12-16 22:23:14+00:00)
Title: prevent remote console access by default

We all know it's super dangerous to have the console plugin running in an unintended environment. The top-level enabled flag covers this pretty well.

But wherever the plugin is enabled, if someone has access to the grails app, they also have access to the console, and therefore have access to the OS and whatever privileges that java/tomcat have access to. e.g. Other developers have access to other developers' machines unless there's a firewall in place. The same security hole exists for any environment where the plugin is enabled.

It seems like a sensible default to deny remote access to the console unless explicitly enabled. This would be a breaking change for people that are currently accessing the console remotely, but it would force them to be acknowledge the security threat. For anyone that's newer to grails or unaware of this risk, it adds another layer of safety.