[
https://issues.apache.org/jira/browse/RANGER-1279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15770143#comment-15770143
]
Colm O hEigeartaigh commented on RANGER-1279:
---------------------------------------------
Review request: https://reviews.apache.org/r/54978/
> Make static variable RangerCSRFPreventionFilter.IS_CSRF_ENABLED private
> -----------------------------------------------------------------------
>
> Key: RANGER-1279
> URL: https://issues.apache.org/jira/browse/RANGER-1279
> Project: Ranger
> Issue Type: Bug
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Fix For: 0.7.0
>
> Attachments:
> 0001-RANGER-1279-Make-static-variable-RangerCSRFPreventio.patch
>
>
> The static configuration variable RangerCSRFPreventionFilter.IS_CSRF_ENABLED
> is public, meaning that a malicious application running in the same JVM as
> Ranger could disable CSRF protection. It should be private instead.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
