[
https://issues.apache.org/jira/browse/JCRVLT-856?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Julian Reschke updated JCRVLT-856:
----------------------------------
Description: A package can contain hidden code (in install hookes) that
runs on the server as soon as the package is opened for installation. The
system starts this code before checking whether the user has permission to
install packages with hooks. So an unauthorized user can trigger the code, and
only afterward is the install refused. The problem affects normal installs,
though test runs (dry runs) skip this step. (was: A package can contain hidden
code (in install hookes) that runs on the server as soon as the package is
opened for installation. The system starts this code before checking whether
the user has permission to install packages with hooks. So an unauthorized user
can trigger the code, and only afterward is the install refused. The problem
affects normal installs, though test runs (dry runs) skip this step.
https://github.com/apache/jackrabbit-filevault-private/issues/3)
> Install Hooks do not properly validate admin access
> ---------------------------------------------------
>
> Key: JCRVLT-856
> URL: https://issues.apache.org/jira/browse/JCRVLT-856
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 4.3.0
>
>
> A package can contain hidden code (in install hookes) that runs on the server
> as soon as the package is opened for installation. The system starts this
> code before checking whether the user has permission to install packages with
> hooks. So an unauthorized user can trigger the code, and only afterward is
> the install refused. The problem affects normal installs, though test runs
> (dry runs) skip this step.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
