Re: Security concern in the way to populate context

Thank you Scott, I filled OFBIZ-3257 https://issues.apache.org/jira/browse/OFBIZ-3257 2009/11/24 Scott Gray > Hi Patrick, > > I think a jira issue for this would be a good idea. > > Regards > Scott > > HotWax Media > http://www.hotwaxmedia.com > > > On 25/11/2009, at 9:12 AM, Patrick Antivackis

Re: Security concern in the way to populate context

Hi Patrick, I think a jira issue for this would be a good idea. Regards Scott HotWax Media http://www.hotwaxmedia.com On 25/11/2009, at 9:12 AM, Patrick Antivackis wrote: Hello, I discover that in the parameters map available in the context, get or post parameters can override session and

Security concern in the way to populate context

Hello, I discover that in the parameters map available in the context, get or post parameters can override session and application attributes. The way to create the parameters map isthe following in UtilHttp.getCombinedMap : combinedMap.putAll(getServletContextMap(request, namesToSkip)); /