[JBoss JIRA] Updated: (JBAS-2453) JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
by Ryan Campbell (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-2453?page=all ]
Ryan Campbell updated JBAS-2453:
--------------------------------
Security: Public (was: JBoss Customer)
> JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
> --------------------------------------
>
> Key: JBAS-2453
> URL: http://jira.jboss.com/jira/browse/JBAS-2453
> Project: JBoss Application Server
> Issue Type: Support Patch
> Security Level: Public(Everyone can see)
> Components: Clustering
> Affects Versions: JBossAS-4.0.3 SP1, JBossAS-4.0.3 Final
> Reporter: Brian Stansberry
> Assigned To: Ryan Campbell
>
> Port the fix for JBAS-2439 to the 4.0.3SP1 code base.
> This patch creates a new jbossha.jar. Comparing the jbossha.jar in 4.0.3 and 4.0.3SP1 shows that they are identical except for irrelevant changes in META-INF/MANIFEST.MF. A diff of the cluster module source code between the 2 release tags also shows no changes. So, the patched jar can be used in 4.0.3 as well, and should be QAed against both releases.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 11 months
[JBoss JIRA] Updated: (JBAS-2453) JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
by Ryan Campbell (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-2453?page=all ]
Ryan Campbell updated JBAS-2453:
--------------------------------
Attachment: (was: jbossha.jar)
> JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
> --------------------------------------
>
> Key: JBAS-2453
> URL: http://jira.jboss.com/jira/browse/JBAS-2453
> Project: JBoss Application Server
> Issue Type: Support Patch
> Security Level: Public(Everyone can see)
> Components: Clustering
> Affects Versions: JBossAS-4.0.3 SP1, JBossAS-4.0.3 Final
> Reporter: Brian Stansberry
> Assigned To: Ryan Campbell
>
> Port the fix for JBAS-2439 to the 4.0.3SP1 code base.
> This patch creates a new jbossha.jar. Comparing the jbossha.jar in 4.0.3 and 4.0.3SP1 shows that they are identical except for irrelevant changes in META-INF/MANIFEST.MF. A diff of the cluster module source code between the 2 release tags also shows no changes. So, the patched jar can be used in 4.0.3 as well, and should be QAed against both releases.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 11 months
[JBoss JIRA] Closed: (JBAS-2453) JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
by Ryan Campbell (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-2453?page=all ]
Ryan Campbell closed JBAS-2453.
-------------------------------
> JBAS-2439 Patch for 4.0.3SP1 and 4.0.3
> --------------------------------------
>
> Key: JBAS-2453
> URL: http://jira.jboss.com/jira/browse/JBAS-2453
> Project: JBoss Application Server
> Issue Type: Support Patch
> Security Level: Public(Everyone can see)
> Components: Clustering
> Affects Versions: JBossAS-4.0.3 SP1, JBossAS-4.0.3 Final
> Reporter: Brian Stansberry
> Assigned To: Ryan Campbell
>
> Port the fix for JBAS-2439 to the 4.0.3SP1 code base.
> This patch creates a new jbossha.jar. Comparing the jbossha.jar in 4.0.3 and 4.0.3SP1 shows that they are identical except for irrelevant changes in META-INF/MANIFEST.MF. A diff of the cluster module source code between the 2 release tags also shows no changes. So, the patched jar can be used in 4.0.3 as well, and should be QAed against both releases.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 11 months
[JBoss JIRA] Closed: (JBAS-3181) LdapExtLoginModule should not log password in TRACE mode
by Ryan Campbell (JIRA)
[ http://jira.jboss.com/jira/browse/JBAS-3181?page=all ]
Ryan Campbell closed JBAS-3181.
-------------------------------
Resolution: Done
> LdapExtLoginModule should not log password in TRACE mode
> --------------------------------------------------------
>
> Key: JBAS-3181
> URL: http://jira.jboss.com/jira/browse/JBAS-3181
> Project: JBoss Application Server
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Components: Security
> Affects Versions: JBossAS-4.0.3 SP1
> Reporter: Anil Saldhana
> Assigned To: Ryan Campbell
> Priority: Critical
> Fix For: JBossAS-4.0.4.GA
>
>
> If you look at the implementation of the method
> private InitialLdapContext constructInitialLdapContext(String dn, Object credential) throws NamingException
> {
> Properties env = new Properties();
> Iterator iter = options.entrySet().iterator();
> ...
> env.setProperty(Context.PROVIDER_URL, providerURL);
> env.setProperty(Context.SECURITY_PRINCIPAL, dn);
> env.put(Context.SECURITY_CREDENTIALS, credential);
> super.log.trace("Logging into LDAP server, env=" + env);
> return new InitialLdapContext(env, null);
> }
> The last few lines will unknowingly log the security credentials of the user. This is bad (legally) for corporate users.
> The lines should read as follows:
> =======================================
> env.setProperty(Context.PROVIDER_URL, providerURL);
> env.setProperty(Context.SECURITY_PRINCIPAL, dn);
> super.log.trace("Logging into LDAP server, env=" + env);
> env.put(Context.SECURITY_CREDENTIALS, credential);
> return new InitialLdapContext(env, null);
> ================================================
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
19 years, 11 months