From c88d34355e069777f03b0ff4e0b4afb957e2478f Mon Sep 17 00:00:00 2001 From: Tuna Aksoy Date: Wed, 8 Nov 2017 18:07:15 +0000 Subject: [PATCH] SEARCH-643 (Resolve SOLR Security Issue on Solr 6 - CVE-2017-12629) --- search-services/alfresco-search/pom.xml | 555 ++++++++++---------- search-services/packaging/config.properties | 4 +- search-services/packaging/pom.xml | 2 - 3 files changed, 282 insertions(+), 279 deletions(-) diff --git a/search-services/alfresco-search/pom.xml b/search-services/alfresco-search/pom.xml index 6ab8c1bcf..b7cfb66df 100644 --- a/search-services/alfresco-search/pom.xml +++ b/search-services/alfresco-search/pom.xml @@ -1,275 +1,280 @@ - - 4.0.0 - alfresco-search - Alfresco Solr Search - jar - - org.alfresco - alfresco-search-parent - 1.2.0-SNAPSHOT - ../pom.xml - - - - - - org.alfresco - alfresco-solrclient - ${alfresco-solrclient.version} - - - servlet-api - javax.servlet - - - - - - - org.apache.lucene - lucene-analyzers-common - ${solr.version} - provided - - - - org.apache.solr - solr-core - ${solr.version} - provided - - - jdk.tools - jdk.tools - - - - - - org.apache.solr - solr-analysis-extras - ${solr.version} - provided - - - - org.apache.solr - solr-langid - ${solr.version} - provided - - - - org.apache.solr - solr-clustering - ${solr.version} - provided - - - - org.slf4j - slf4j-api - 1.7.12 - - - - org.slf4j - slf4j-log4j12 - 1.7.12 - - - - - junit - junit - 4.12 - test - - - - org.mockito - mockito-all - 1.10.19 - test - - - - org.apache.solr - solr-test-framework - ${solr.version} - test - - - com.carrotsearch.randomizedtesting - randomizedtesting-runner - 2.5.0 - test - - - org.apache.chemistry.opencmis - chemistry-opencmis-client-impl - 0.11.0 - test - - - - - edu.emory.mathcs.nlp - nlp4j - 1.1.2 - test - - - - edu.emory.mathcs.nlp - nlp4j-english - 1.1.2 - test - - - - - alfresco-solr - - - maven-surefire-plugin - - - **/*Suite.java - **/*Test.java - - - **/CMISDataCreatorTest.java - - - - - maven-resources-plugin - 3.0.1 - - - copy-production-config - generate-test-resources - - copy-resources - - - ${project.build.testOutputDirectory}/test-files - - - src/main/resources/solr/instance - - - - - - default-testResources - - true - - - - - - org.apache.maven.plugins - maven-antrun-plugin - - - write-alfresco-version - prepare-package - - run - - - - - - - - - - - - - - - org.apache.maven.plugins - maven-dependency-plugin - - - copy-dependencies - prepare-package - - copy-dependencies - - - ${project.build.outputDirectory}/libs - compile - false - false - true - - - - - - org.apache.maven.plugins - maven-jar-plugin - - - default-jar - - - libs/**/* - webapp/**/* - - - - - package-libs - package - - jar - - - libs - - solr/**/* - org/**/* - **/jetty-*.jar - **/slf4j*.jar - **/log4j*.jar - **/junit*.jar - **/mock*.jar - **/opencmis*.jar - **/metrics*.jar - **/gmetric*.jar - - - - - create-test-jar - - test-jar - - - - - - maven-source-plugin - - - attach-sources - - jar - - - - - - - + + 4.0.0 + alfresco-search + Alfresco Solr Search + jar + + org.alfresco + alfresco-search-parent + 1.2.0-SNAPSHOT + ../pom.xml + + + + + + org.alfresco + alfresco-solrclient + ${alfresco-solrclient.version} + + + servlet-api + javax.servlet + + + + + + + org.apache.lucene + lucene-analyzers-common + ${solr.version} + provided + + + + org.apache.solr + solr-core + ${solr.version} + provided + + + jdk.tools + jdk.tools + + + + + + org.apache.solr + solr-analysis-extras + ${solr.version} + provided + + + + org.apache.solr + solr-langid + ${solr.version} + provided + + + xercesImpl + xerces + + + + + + org.apache.solr + solr-clustering + ${solr.version} + provided + + + + org.slf4j + slf4j-api + 1.7.12 + + + + org.slf4j + slf4j-log4j12 + 1.7.12 + + + + + junit + junit + 4.12 + test + + + + org.mockito + mockito-all + 1.10.19 + test + + + + org.apache.solr + solr-test-framework + ${solr.version} + test + + + com.carrotsearch.randomizedtesting + randomizedtesting-runner + 2.5.0 + test + + + org.apache.chemistry.opencmis + chemistry-opencmis-client-impl + 0.11.0 + test + + + + + edu.emory.mathcs.nlp + nlp4j + 1.1.2 + test + + + + edu.emory.mathcs.nlp + nlp4j-english + 1.1.2 + test + + + + + alfresco-solr + + + maven-surefire-plugin + + + **/*Suite.java + **/*Test.java + + + **/CMISDataCreatorTest.java + + + + + maven-resources-plugin + + + copy-production-config + generate-test-resources + + copy-resources + + + ${project.build.testOutputDirectory}/test-files + + + src/main/resources/solr/instance + + + + + + default-testResources + + true + + + + + + org.apache.maven.plugins + maven-antrun-plugin + + + write-alfresco-version + prepare-package + + run + + + + + + + + + + + + + + + org.apache.maven.plugins + maven-dependency-plugin + + + copy-dependencies + prepare-package + + copy-dependencies + + + ${project.build.outputDirectory}/libs + compile + false + false + true + + + + + + org.apache.maven.plugins + maven-jar-plugin + + + default-jar + + + libs/**/* + webapp/**/* + + + + + package-libs + package + + jar + + + libs + + solr/**/* + org/**/* + **/jetty-*.jar + **/slf4j*.jar + **/log4j*.jar + **/junit*.jar + **/mock*.jar + **/opencmis*.jar + **/metrics*.jar + **/gmetric*.jar + + + + + create-test-jar + + test-jar + + + + + + maven-source-plugin + + + attach-sources + + jar + + + + + + + diff --git a/search-services/packaging/config.properties b/search-services/packaging/config.properties index d9e023d1f..73bd605de 100644 --- a/search-services/packaging/config.properties +++ b/search-services/packaging/config.properties @@ -7,6 +7,6 @@ alfresco.gc.logs.win=set "GC_LOG_OPTS= " alfresco.search.logs.win=set SOLR_LOGS_DIR=..\\..\\logs\ ${line.separator}set LOG4J_CONFIG=!SOLR_LOGS_DIR!\\log4j.properties alfresco.search.config=# Alfresco configuration. This file is automatically included by solr. You can define your custom settings here\ -${line.separator}SOLR_OPTS="$SOLR_OPTS -Dsolr.jetty.request.header.size=1000000 -Dsolr.jetty.threads.stop.timeout=300000" +${line.separator}SOLR_OPTS="$SOLR_OPTS -Dsolr.jetty.request.header.size=1000000 -Dsolr.jetty.threads.stop.timeout=300000 -Ddisable.configEdit=true" alfresco.search.config.win=REM Alfresco configuration. This file is automatically included by solr. You can define your custom settings here\ -${line.separator}set SOLR_OPTS=%SOLR_OPTS% -Dsolr.jetty.request.header.size=1000000 -Dsolr.jetty.threads.stop.timeout=300000 \ No newline at end of file +${line.separator}set SOLR_OPTS=%SOLR_OPTS% -Dsolr.jetty.request.header.size=1000000 -Dsolr.jetty.threads.stop.timeout=300000 -Ddisable.configEdit=true \ No newline at end of file diff --git a/search-services/packaging/pom.xml b/search-services/packaging/pom.xml index 46caad408..ea24e181f 100644 --- a/search-services/packaging/pom.xml +++ b/search-services/packaging/pom.xml @@ -37,7 +37,6 @@ org.codehaus.mojo properties-maven-plugin - 1.0.0 initialize @@ -55,7 +54,6 @@ org.apache.maven.plugins maven-dependency-plugin - 2.10 unpack-solr-war