[JBoss JIRA] Created: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
2:30 p.m.
rich:fileUpload createTempfiles directory should be made configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.3.0
Environment: All
Reporter: sathay sayee
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:20 p.m.
New subject: [JBoss JIRA] Updated: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Nick Belaevski updated RF-6525:
-------------------------------
Issue Type: Feature Request (was: Bug)
Affects: [Documentation (Ref Guide, User Guide, etc.), Interactive Demo/Tutorial,
Release Notes] (was: [Release Notes, Interactive Demo/Tutorial, Documentation (Ref Guide,
User Guide, etc.)])
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Affects Versions: 3.3.0
Environment: All
Reporter: sathay sayee
Fix For: Wishes
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:20 p.m.
New subject: [JBoss JIRA] Updated: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Nick Belaevski updated RF-6525:
-------------------------------
Fix Version/s: Wishes
Affects: [Documentation (Ref Guide, User Guide, etc.), Interactive
Demo/Tutorial, Release Notes] (was: [Release Notes, Interactive Demo/Tutorial,
Documentation (Ref Guide, User Guide, etc.)])
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.3.0
Environment: All
Reporter: sathay sayee
Fix For: Wishes
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:50 a.m.
New subject: [JBoss JIRA] Commented: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Lex Luthor commented on RF-6525:
--------------------------------
Is there any workaround at this moment (3.3.0 version) for this issue?
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Fix For: Wishes
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:41 p.m.
New subject: [JBoss JIRA] Assigned: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Jay Balunas reassigned RF-6525:
-------------------------------
Assignee: Konstantin Mishin
This is a potential security issues, and should be fairly simple to implement.
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: Future
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:43 p.m.
New subject: [JBoss JIRA] Issue Comment Edited: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Jay Balunas edited comment on RF-6525 at 4/22/10 9:41 PM:
----------------------------------------------------------
This is a potential security issues since files can be left on server, and should be
fairly simple to implement.
was (Author: jbalunas(a)redhat.com):
This is a potential security issues, and should be fairly simple to implement.
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: Future
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:18 p.m.
New subject: [JBoss JIRA] Resolved: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Konstantin Mishin resolved RF-6525.
-----------------------------------
Fix Version/s: 3.3.4.BETA1
(was: Future)
Resolution: Done
Name of init-param is "tempFilesDirectory".
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.4.BETA1
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:20 p.m.
New subject: [JBoss JIRA] Commented: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
Konstantin Mishin commented on RF-6525:
---------------------------------------
Sample of using:
<filter>
...
<init-param>
<param-name>tempFilesDirectory</param-name>
<param-value>d:</param-value>
</init-param>
...
</filter>
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.4.BETA1
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:58 p.m.
New subject: [JBoss JIRA] Commented: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/jira/browse/RF-6525?page=com.atlassian.jira.plugin...
]
sathya sayee commented on RF-6525:
----------------------------------
Wonderful. Will test with the new build.
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/jira/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.4.BETA1
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:16 a.m.
New subject: [JBoss JIRA] Updated: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/browse/RF-6525?page=com.atlassian.jira.plugin.syst...
]
Rodney Russ updated RF-6525:
----------------------------
Fix Version/s: ENT_3.3.1.SP2
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.4.BETA1, ENT_3.3.1.SP2
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:46 a.m.
New subject: [JBoss JIRA] Commented: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://jira.jboss.org/browse/RF-6525?page=com.atlassian.jira.plugin.syst...
]
Laura Bailey commented on RF-6525:
----------------------------------
Documented as a known issue in the WFK 1.1 release notes:
When the <classname>rich:fileUpload</classname> control's
<varname>createTempFile</varname>
is set to <literal>true</literal>, temp files are created in
<filename><replaceable>$INSTALL_DIR</replaceable>/temp</filename>.
Previously this was
not configurable, and posed a security risk because the files would not be
deleted
until application restart. The temp directory's location and behavior is
now configurable.
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://jira.jboss.org/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.4.BETA1, ENT_3.3.1.SP2
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:14 p.m.
New subject: [JBoss JIRA] Commented: (RF-6525) rich:fileUpload createTempfiles directory should be made configurable.
[
https://issues.jboss.org/browse/RF-6525?page=com.atlassian.jira.plugin.sy...
]
Felipe Affonao commented on RF-6525:
------------------------------------
Could you guys update the userguide?
I spent a long time googling how to do this.
It could help a lot of people.
Thanks!
rich:fileUpload createTempfiles directory should be made
configurable.
----------------------------------------------------------------------
Key: RF-6525
URL: https://issues.jboss.org/browse/RF-6525
Project: RichFaces
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Affects Versions: 3.3.0
Environment: All
Reporter: sathya sayee
Assignee: Konstantin Mishin
Fix For: 3.3.1.SP2, 3.3.4.BETA1
rich:fileUpload control's createTempFile can be configured as init-param in web.xml.
The real problem is when createTempfile is true, the temp files in linux environment gets
created in the <tomcat installation directory>/temp. This should be configurable and
poses a security risk since the temp files do not even get deleted until the application
is restarted.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
4971
days inactive
5766
days old
richfaces-issues@lists.jboss.org
11 comments
9 participants
participants (9)
-
Felipe Affonao (JIRA) -
Jay Balunas (JIRA)
-
Konstantin Mishin (JIRA)
-
Laura Bailey (JIRA)
-
Lex Luthor (JIRA)
-
Nick Belaevski (JIRA)
-
Rodney Russ (JIRA)
-
sathay sayee (JIRA)
-
sathya sayee (JIRA)