Would that file store also be under solr.home? Because if it is and the user can upload core.property into it as well as other things that core discovery will then load bypassing security....
Regards, Alex. On Fri, 25 Sep 2020 at 08:32, David Smiley <dsmi...@apache.org> wrote: > > I'm looking to see that we can deprecate "userfiles" and remove for 9.0 > > Solr has a "userfiles" directory under Solr home that Jason added in some > issue relating to streaming expressions accessing a local file. I bet only a > few of you have even heard of it. I think the "File Store" that came along > with the package manager obsoletes "userfiles". If you have not heard of the > file store either, I wouldn't be surprised -- it's new and it's name was > changed from "package store" last minute, since it's general purpose, with > "packages" being a directory at the root of the file store for packages. > It's documented as the "package store" (should be renamed) on the package > manager internals doc: > https://lucene.apache.org/solr/guide/8_6/package-manager-internals.html#package-store > However IMO it's worthy of its own doc page as it's a very useful new > component of the Solr platform. It can store "user files" (hence obsoleting > the userfiles dir), ML models, or basically any file that's too large to put > in ZK. I'd be nice if SolrResourceLoader could resolve resources from it -- > an issue for another day. That would be another avenue of use separate from > the configSet. You can already upload single files to the file store :-) > > ~ David Smiley > Apache Lucene/Solr Search Developer > http://www.linkedin.com/in/davidwsmiley --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@lucene.apache.org For additional commands, e-mail: dev-h...@lucene.apache.org
