This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new b3ead19c4c Fixed: Allow the content upload directory in the default
LOCAL_FILE allow-list (OFBIZ-13689)
b3ead19c4c is described below
commit b3ead19c4c845825a56e94834d31e6e25e729712
Author: Mridul Pathak <[email protected]>
AuthorDate: Fri Oct 16 13:09:29 2026 +0530
Fixed: Allow the content upload directory in the default LOCAL_FILE
allow-list (OFBIZ-13689)
Uploads stored as LOCAL_FILE data resources are written under
${ofbiz.home}/runtime/uploads/ (content.upload.path.prefix), but the default
content.data.local.file.allowed.paths only allowed ${ofbiz.home}/runtime/tmp/,
so SecurityUtil.checkLocalFileAllowList rejected every such upload with "Access
to file denied: path is not within an allowed directory" and the transaction
rolled back, and LOCAL_FILE resources uploaded earlier could no longer be
rendered. Add the upload directory to th [...]
---
framework/security/config/security.properties | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/framework/security/config/security.properties
b/framework/security/config/security.properties
index 08cc1973a2..ba732de6e5 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -173,7 +173,9 @@
content.data.ofbiz.file.allowed.paths=applications/,themes/,plugins/,runtime/
# -- Allowed directories for the LOCAL_FILE / LOCAL_FILE_BIN data resource
types (absolute paths).
# -- Comma-separated, no spaces after commas. Use ${ofbiz.home} as a portable
placeholder.
# -- Only files whose resolved canonical path starts with one of these entries
will be served.
-content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/
+# -- Must include the content upload directory (content.upload.path.prefix in
content.properties),
+# -- otherwise uploads stored as LOCAL_FILE fail.
+content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/,${ofbiz.home}/runtime/uploads/
# -- Allowed hosts for the URL_RESOURCE data resource type (comma-separated
host names or host:port values).
# -- Both exact matches and subdomain matches are supported: "example.com"
also permits "cdn.example.com".
