This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 5611b685dc Fixed: Allow the content upload directory in the default
LOCAL_FILE allow-list (OFBIZ-13689)
5611b685dc is described below
commit 5611b685dcf7c1221f04935fab835f8f5a5397c9
Author: Mridul Pathak <[email protected]>
AuthorDate: Fri Oct 16 13:09:29 2026 +0530
Fixed: Allow the content upload directory in the default LOCAL_FILE
allow-list (OFBIZ-13689)
Uploads stored as LOCAL_FILE data resources are written under
${ofbiz.home}/runtime/uploads/ (content.upload.path.prefix), but the default
content.data.local.file.allowed.paths only allowed ${ofbiz.home}/runtime/tmp/,
so SecurityUtil.checkLocalFileAllowList rejected every such upload with "Access
to file denied: path is not within an allowed directory" and the transaction
rolled back, and LOCAL_FILE resources uploaded earlier could no longer be
rendered. Add the upload directory to th [...]
---
framework/security/config/security.properties | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/framework/security/config/security.properties
b/framework/security/config/security.properties
index 5d0c06ba79..65b1e4ff4a 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -188,7 +188,9 @@
content.data.ofbiz.file.allowed.paths=applications/,themes/,plugins/,runtime/
# -- Allowed directories for the LOCAL_FILE / LOCAL_FILE_BIN data resource
types (absolute paths).
# -- Comma-separated, no spaces after commas. Use ${ofbiz.home} as a portable
placeholder.
# -- Only files whose resolved canonical path starts with one of these entries
will be served.
-content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/
+# -- Must include the content upload directory (content.upload.path.prefix in
content.properties),
+# -- otherwise uploads stored as LOCAL_FILE fail.
+content.data.local.file.allowed.paths=${ofbiz.home}/runtime/tmp/,${ofbiz.home}/runtime/uploads/
# -- Allowed hosts for the URL_RESOURCE data resource type (comma-separated
host names or host:port values).
# -- Both exact matches and subdomain matches are supported: "example.com"
also permits "cdn.example.com".
