This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new 33b88a85d [OPENMEETINGS-2830] crypt.class.name is validated while
setting
33b88a85d is described below
commit 33b88a85d8af10d927319728b86d148d9dc0a464
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Thu Aug 27 12:22:04 2026 +0700
[OPENMEETINGS-2830] crypt.class.name is validated while setting
---
.../db/dao/basic/ConfigurationDao.java | 24 ++++++++++++++++++++++
.../db/dao/calendar/AppointmentDao.java | 2 +-
2 files changed, 25 insertions(+), 1 deletion(-)
diff --git
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
index e23958c00..09a3f4008 100644
---
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
+++
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
@@ -25,6 +25,7 @@ import static
org.apache.openmeetings.util.OpenmeetingsVariables.*;
import static org.apache.wicket.csp.CSPDirectiveSrcValue.SELF;
import static org.apache.wicket.csp.CSPDirectiveSrcValue.STRICT_DYNAMIC;
+import java.lang.reflect.Constructor;
import java.net.UnknownHostException;
import java.util.ArrayList;
import java.util.Date;
@@ -49,6 +50,7 @@ import org.apache.openmeetings.db.dao.user.UserDao;
import org.apache.openmeetings.db.entity.basic.Configuration;
import org.apache.openmeetings.db.util.DaoHelper;
import org.apache.openmeetings.util.crypt.CryptProvider;
+import org.apache.openmeetings.util.crypt.ICrypt;
import org.apache.wicket.Application;
import org.apache.wicket.csp.CSPDirective;
import org.apache.wicket.csp.CSPHeaderConfiguration;
@@ -226,6 +228,28 @@ public class ConfigurationDao implements
IDataProviderDao<Configuration> {
public Configuration update(Configuration entity, Long userId, boolean
deleted) {
String key = entity.getKey();
String value = entity.getValue();
+ if (CONFIG_CRYPT.equals(key)) {
+ if (deleted) {
+ log.error("An attempt to delete '" +
CONFIG_CRYPT + "' is blocked");
+ return entity;
+ }
+ boolean validClass = false;
+ try {
+ Class<?> clazz = Class.forName(value);
+ if (ICrypt.class.isAssignableFrom(clazz)) {
+ Constructor<?> constr =
clazz.getDeclaredConstructor();
+ constr.setAccessible(true);
+ Object crypt = constr.newInstance();
+ validClass = crypt instanceof ICrypt;
+ }
+ } catch (Exception e) {
+ // no-op
+ }
+ if (!validClass) {
+ log.error("An attempt to set '" + value + "' as
'" + CONFIG_CRYPT + "' is blocked");
+ return entity;
+ }
+ }
if (entity.getId() == null || entity.getId().longValue() <= 0) {
entity.setDeleted(deleted);
entity.setInserted(new Date());
diff --git
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
index 00e46918f..1d7cca6df 100644
---
a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
+++
b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
@@ -273,7 +273,7 @@ public class AppointmentDao implements
IDataProviderDao<Appointment>{
* @param calId Calendar Id of the Calendar Id to which the
Appointments belong to.
* @return Returns <code>-1</code> if the there was an error executing
the query,
* otherwise returns the number of updated rows.
- * as described here {@link jakarta.persistence.Query.#executeUpdate()}
+ * as described here {@link jakarta.persistence.Query.executeUpdate()}
*/
public int deletebyCalendar(Long calId) {
return em.createNamedQuery("deleteAppointmentsbyCalendar",
Appointment.class)
