April 2020 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELYWEB-103) Add support for scope ID changes.

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELYWEB-103?page=com.atlassian.jira.plugi... ] Darran Lofthouse updated ELYWEB-103: ------------------------------------ Summary: Add support for scope ID changes. (was: Elytron Web Fixes) > Add support for scope ID changes. > --------------------------------- > > Key: ELYWEB-103 > URL: https://issues.redhat.com/browse/ELYWEB-103 > Project: Elytron Web > Issue Type: Bug > Components: Undertow Servlet > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Major > Fix For: 1.2.5.CR1, 1.7.1.CR1 > > -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELY-1945) Authentication vulnerable to session fixation attacks

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1945?page=com.atlassian.jira.plugin.... ] Darran Lofthouse updated ELY-1945: ---------------------------------- Fix Version/s: 1.11.5.CR1 (was: 1.11.4.Final) > Authentication vulnerable to session fixation attacks > ----------------------------------------------------- > > Key: ELY-1945 > URL: https://issues.redhat.com/browse/ELY-1945 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Mark Banierink > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 1.6.7.Final, 1.11.4.Final > > > The session id is not changed upon authentication. This creates a vulnerability to session fixation attacks. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELY-1931) Upgrade SmallRye JWT to 2.0.13

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1931?page=com.atlassian.jira.plugin.... ] Darran Lofthouse updated ELY-1931: ---------------------------------- Fix Version/s: 1.11.5.CR1 (was: 1.11.4.Final) > Upgrade SmallRye JWT to 2.0.13 > ------------------------------ > > Key: ELY-1931 > URL: https://issues.redhat.com/browse/ELY-1931 > Project: WildFly Elytron > Issue Type: Component Upgrade > Components: MicroProfile > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Major > Fix For: 1.11.5.CR1 > > -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELY-1954) Submission for "j_security_check" login does not work if URL has no trailing slash

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1954?page=com.atlassian.jira.plugin.... ] Darran Lofthouse resolved ELY-1954. ----------------------------------- Fix Version/s: 1.11.4.CR1 Resolution: Done > Submission for "j_security_check" login does not work if URL has no trailing slash > ---------------------------------------------------------------------------------- > > Key: ELY-1954 > URL: https://issues.redhat.com/browse/ELY-1954 > Project: WildFly Elytron > Issue Type: Bug > Components: HTTP > Reporter: Wolfgang Knauf > Assignee: Darran Lofthouse > Priority: Major > Fix For: 1.11.4.CR1 > > Attachments: Security.ear, configure.cli, restore-configuration.cli > > > Attached file "Security.ear" contains a web application with a single jsp page "index.jsp" and form based login, which is secured by a Database Identity Store (Elytron). > When calling the root URL of the webapp without specifiying any page and {color:red}*no*{color} trailing slash (http://localhost:8080/SecurityWeb), on WildFly 11 the login form is shown, and then the welcome file "index.jsp" is shown. > On WildFly 19, the login form is shown, and after successful login, there is an error message "404 - Not Found", and the URL in the adress bar changes to http://localhost:8080/j_security_check > It works if the URL is "http://localhost:8080/SecurityWeb/" (trailing slash). It seems WildFly 11 appends the "/" automatically when redirecting to the login form, while WildFly 19 keeps this URL. > To run the sample, you have to add the Elytron config - the script "configure.cli" can be used for this: > jboss-cli.bat --file=path_to\configure.cli > The script "restore-configuration.cli" undoes this configuration. > Username/Password are e.g. "admin"/"admin" - the sample creates a user table based on an ejb and "import.sql" inserts users. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELY-1945) Authentication vulnerable to session fixation attacks

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1945?page=com.atlassian.jira.plugin.... ] Darran Lofthouse updated ELY-1945: ---------------------------------- Fix Version/s: 1.6.7.Final 1.11.4.CR1 > Authentication vulnerable to session fixation attacks > ----------------------------------------------------- > > Key: ELY-1945 > URL: https://issues.redhat.com/browse/ELY-1945 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Mark Banierink > Assignee: Darran Lofthouse > Priority: Critical > Fix For: 1.6.7.Final, 1.11.4.CR1 > > > The session id is not changed upon authentication. This creates a vulnerability to session fixation attacks. -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELY-1957) Release WildFly Elytron 1.11.4.Final

by Darran Lofthouse (Jira)

[ https://issues.redhat.com/browse/ELY-1957?page=com.atlassian.jira.plugin.... ] Darran Lofthouse resolved ELY-1957. ----------------------------------- Resolution: Done > Release WildFly Elytron 1.11.4.Final > ------------------------------------ > > Key: ELY-1957 > URL: https://issues.redhat.com/browse/ELY-1957 > Project: WildFly Elytron > Issue Type: Release > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Priority: Major > Fix For: 1.11.4.CR1 > > -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (JGRP-2472) TCPConnection allocates 1.5G after reading incorrect header in the connection

by Bela Ban (Jira)

[ https://issues.redhat.com/browse/JGRP-2472?page=com.atlassian.jira.plugin... ] Bela Ban resolved JGRP-2472. ---------------------------- Resolution: Duplicate Issue Duplicate of JGRP-2135 > TCPConnection allocates 1.5G after reading incorrect header in the connection > ----------------------------------------------------------------------------- > > Key: JGRP-2472 > URL: https://issues.redhat.com/browse/JGRP-2472 > Project: JGroups > Issue Type: Bug > Affects Versions: 3.6.13 > Reporter: Pavel Molchanov > Assignee: Bela Ban > Priority: Major > Attachments: 2020-04-21_12h58_50.png, 2020-04-21_15h38_37.png > > > We are using FILE_PING JGroups functionality with Artemis servers. > Periodically (very rate) we see that TCPConnection allocates 1650814049 bytes in the receiving buffer. > This is similar to the https://issues.redhat.com/browse/JGRP-1117 issue. > This issue is happening periodically and it's clearly visible in the memory dumps from Artemis servers. > Screen-shots of the dumps are attached. > Can TCPConnection be protected from the incorrect input? > https://github.com/belaban/JGroups/blob/JGroups-3.6.13.Final/src/org/jgro... > Something like this: > {code} > int len=in.readInt(); > if(len==1650814049) throw InvalidStateException(); > {code} -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (ELYWEB-107) Upgrade WildFly Elytron to 1.11.4.Final

by Darran Lofthouse (Jira)

Darran Lofthouse created ELYWEB-107: --------------------------------------- Summary: Upgrade WildFly Elytron to 1.11.4.Final Key: ELYWEB-107 URL: https://issues.redhat.com/browse/ELYWEB-107 Project: Elytron Web Issue Type: Component Upgrade Reporter: Darran Lofthouse Assignee: Darran Lofthouse Fix For: 1.7.1.CR1 -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (DROOLS-5139) [DMN Designer] Decision Navigator does not update Diagram name

by Yeser Amer (Jira)

[ https://issues.redhat.com/browse/DROOLS-5139?page=com.atlassian.jira.plug... ] Yeser Amer updated DROOLS-5139: ------------------------------- Sprint: (was: 2020 Week 16-18 (from Apr 13)) > [DMN Designer] Decision Navigator does not update Diagram name > -------------------------------------------------------------- > > Key: DROOLS-5139 > URL: https://issues.redhat.com/browse/DROOLS-5139 > Project: Drools > Issue Type: Bug > Components: DMN Editor > Affects Versions: 7.34.0.Final > Reporter: Michael Anstis > Assignee: Yeser Amer > Priority: Major > Labels: drools-tools > > Following changes for https://issues.redhat.com/browse/DROOLS-5137 it became evident that the Decision Navigator does not show updated Diagram names. > This pre-exists DROOLS-5137 and DROOLS-5060 (i.e. it is not a regression), so this new JIRA has been created. > * Create a new DMN Diagram > * Expand Decision Navigator > * Expand Properties Panel > * Select _background_ i.e. _diagram_ > * Change name in Properties Panel > * Decision Navigator does not update > * Saving, closing and re-opening diagram shows updated name -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

[JBoss JIRA] (DROOLS-5282) Client side FEEL

by Toni Rikkola (Jira)

Toni Rikkola created DROOLS-5282: ------------------------------------ Summary: Client side FEEL Key: DROOLS-5282 URL: https://issues.redhat.com/browse/DROOLS-5282 Project: Drools Issue Type: Bug Reporter: Toni Rikkola Assignee: Toni Rikkola Make kie-dmn-feel usable in the client side. Notes: * FEEL functions use reflection, but many if not all of them can be hard coded -- This message was sent by Atlassian Jira (v7.13.8#713008)

6 years

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira April 2020