[
https://issues.apache.org/jira/browse/RANGER-1279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16793327#comment-16793327
]
Michael Dennis Uanang commented on RANGER-1279:
-----------------------------------------------
How to use the patch on Ranger v0.5? Sorry for the noob question.. I have a
prod running ranger on my cluster, need to secure it. Or is it recommended to
upgrade?
Thank you!
> Make static variable RangerCSRFPreventionFilter.IS_CSRF_ENABLED private
> -----------------------------------------------------------------------
>
> Key: RANGER-1279
> URL: https://issues.apache.org/jira/browse/RANGER-1279
> Project: Ranger
> Issue Type: Bug
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 0.7.0
>
> Attachments:
> 0001-RANGER-1279-Make-static-variable-RangerCSRFPreventio.patch
>
>
> The static configuration variable RangerCSRFPreventionFilter.IS_CSRF_ENABLED
> is public, meaning that a malicious application running in the same JVM as
> Ranger could disable CSRF protection. It should be private instead.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
