Repository: hadoop Updated Branches: refs/heads/branch-3.0 c6becec39 -> f13e01fdf
HDFS-13636. Cross-Site Scripting vulnerability in HttpServer2 (Contributed by Haibo Yan via Daniel Templeton) Change-Id: I28edde8125dd20d8d270f0e609d1c04d8173c8b7 (cherry picked from commit cba319499822a2475c60c43ea71f8e78237e139f) (cherry picked from commit 09fd1348e855302f6f238917a98997d935c373c8) Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/f13e01fd Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/f13e01fd Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/f13e01fd Branch: refs/heads/branch-3.0 Commit: f13e01fdfe0e6c2bce5f9615074c7c90fa65d91c Parents: c6becec Author: Daniel Templeton <[email protected]> Authored: Fri Jun 1 14:42:39 2018 -0700 Committer: Daniel Templeton <[email protected]> Committed: Fri Jun 1 14:45:01 2018 -0700 ---------------------------------------------------------------------- .../src/main/java/org/apache/hadoop/http/HttpServer2.java | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/f13e01fd/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java index b6c2f19..e83f7f8 100644 --- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java +++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java @@ -1358,8 +1358,11 @@ public final class HttpServer2 implements FilterContainer { if (servletContext.getAttribute(ADMINS_ACL) != null && !userHasAdministratorAccess(servletContext, remoteUser)) { - response.sendError(HttpServletResponse.SC_FORBIDDEN, "User " - + remoteUser + " is unauthorized to access this page."); + response.sendError(HttpServletResponse.SC_FORBIDDEN, + "Unauthenticated users are not " + + "authorized to access this page."); + LOG.warn("User " + remoteUser + " is unauthorized to access the page " + + request.getRequestURI() + "."); return false; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
