This is an automated email from the ASF dual-hosted git repository. jleroux pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/ofbiz-site.git
The following commit(s) were added to refs/heads/master by this push: new cfc7d5e Adds a mention for security reporters to not create Jira issues for pre-auth (aka unauth) reports cfc7d5e is described below commit cfc7d5ebba04d1aa62803afb1bb8784de5947501 Author: Jacques Le Roux <jacques.le.r...@les7arts.com> AuthorDate: Mon Feb 21 14:51:06 2022 +0100 Adds a mention for security reporters to not create Jira issues for pre-auth (aka unauth) reports --- download.html | 3 ++- security.html | 2 +- template/page/download.tpl.php | 3 ++- template/page/security.tpl.php | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/download.html b/download.html index 3223c7a..85954da 100644 --- a/download.html +++ b/download.html @@ -282,7 +282,8 @@ available <a href="security.html">here</a></p> <p>Note that we no longer create CVEs for post-auth attacks done using demo credentials, notably using the admin user. - <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a></strong></p> + <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a><span style="color:red"> Please don't create Jira issues for unauth (aka pre-auth) reports, thanks in advance.</span></strong></p> + <p>One of the reason we no longer create CVEs for post-auth attacks done using demo credentials is because <a href="https://nightlies.apache.org/ofbiz/trunk/readme/html5/#security" target="external"> we highly suggest to OFBiz users to not use credentials demo in production</a> diff --git a/security.html b/security.html index 5e3e608..f5712a7 100644 --- a/security.html +++ b/security.html @@ -135,7 +135,7 @@ before disclosing them in a public forum. Please don't pack several vulnerabilities in the same report, send them one by one, thanks in advance.</strong></p> <p>Note that we no longer create CVEs for post-auth attacks done using demo credentials, notably using the admin user. - <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a></strong></p> + <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a><span style="color:red"> Please don't create Jira issues for unauth (aka pre-auth) reports, thanks in advance.</span></strong></p> <p>One of the reason we no longer create CVEs for post-auth attacks done using demo credentials is because <a href="https://nightlies.apache.org/ofbiz/trunk/readme/html5/#security" target="external"> we highly suggest to OFBiz users to not use credentials demo in production</a> diff --git a/template/page/download.tpl.php b/template/page/download.tpl.php index 5affad8..e691b8e 100644 --- a/template/page/download.tpl.php +++ b/template/page/download.tpl.php @@ -171,7 +171,8 @@ available <a href="security.html">here</a></p> <p>Note that we no longer create CVEs for post-auth attacks done using demo credentials, notably using the admin user. - <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a></strong></p> + <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a><span style="color:red"> Please don't create Jira issues for unauth (aka pre-auth) reports, thanks in advance.</span></strong></p> + <p>One of the reason we no longer create CVEs for post-auth attacks done using demo credentials is because <a href="https://nightlies.apache.org/ofbiz/trunk/readme/html5/#security" target="external"> we highly suggest to OFBiz users to not use credentials demo in production</a> diff --git a/template/page/security.tpl.php b/template/page/security.tpl.php index 33d20ce..67f7650 100644 --- a/template/page/security.tpl.php +++ b/template/page/security.tpl.php @@ -24,7 +24,7 @@ before disclosing them in a public forum. Please don't pack several vulnerabilities in the same report, send them one by one, thanks in advance.</strong></p> <p>Note that we no longer create CVEs for post-auth attacks done using demo credentials, notably using the admin user. - <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a></strong></p> + <strong> <a href="https://s.apache.org/dsj2p"> Rather create bugs reports in our issue tracker (Jira) for that.</a><span style="color:red"> Please don't create Jira issues for unauth (aka pre-auth) reports, thanks in advance.</span></strong></p> <p>One of the reason we no longer create CVEs for post-auth attacks done using demo credentials is because <a href="https://nightlies.apache.org/ofbiz/trunk/readme/html5/#security" target="external"> we highly suggest to OFBiz users to not use credentials demo in production</a>