[
https://issues.apache.org/jira/browse/JCRVLT-856?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Konrad Windszus closed JCRVLT-856.
----------------------------------
> Install Hooks do not properly validate admin access
> ---------------------------------------------------
>
> Key: JCRVLT-856
> URL: https://issues.apache.org/jira/browse/JCRVLT-856
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 4.3.0
>
>
> A package can contain hidden code (in install hookes) that runs on the server
> as soon as the package is opened for installation. The system starts this
> code before checking whether the user has permission to install packages with
> hooks. So an unauthorized user can trigger the code, and only afterward is
> the install refused. The problem affects normal installs, though test runs
> (dry runs) skip this step.
> https://github.com/apache/jackrabbit-filevault-private/issues/3
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
