[
https://issues.apache.org/jira/browse/JCRVLT-856?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132386#comment-18132386
]
Rishabh Daim commented on JCRVLT-856:
-------------------------------------
Fixed in 3.2.x in
https://github.com/apache/jackrabbit-filevault/commit/123badfcaa7d94a826bc5298c0c9187098b3a342
> Install Hooks do not properly validate admin access
> ---------------------------------------------------
>
> Key: JCRVLT-856
> URL: https://issues.apache.org/jira/browse/JCRVLT-856
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 3.2.10, 4.3.0
>
>
> A package can contain hidden code (in install hookes) that runs on the server
> as soon as the package is opened for installation. The system starts this
> code before checking whether the user has permission to install packages with
> hooks. So an unauthorized user can trigger the code, and only afterward is
> the install refused. The problem affects normal installs, though test runs
> (dry runs) skip this step.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
