[ https://issues.apache.org/jira/browse/SOLR-14049?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17068736#comment-17068736 ]
Marcus Eagan commented on SOLR-14049: ------------------------------------- it is the same thought that I had. We don't have that distinction to my knowledge today. There was a time, or at least in the documentation, where I felt like SolrCloud meant production. I don't think that's true today. Perhaps we should add a production flag to the start scripts? > Disable Config APIs by default > ------------------------------ > > Key: SOLR-14049 > URL: https://issues.apache.org/jira/browse/SOLR-14049 > Project: Solr > Issue Type: Improvement > Reporter: Ishan Chattopadhyaya > Priority: Major > > Spin off from SOLR-13978. This is not my proposal (I support this only > conditionally), I'm just opening the JIRA. > Proposal is to do this by 8.4. Reason is that Config APIs have been used in > the past to invoke RCE vulnerabilities in some components of Solr. > The discussion has happened in SOLR-13978. I am willing to do the work once > we have agreement on this. -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org For additional commands, e-mail: issues-h...@lucene.apache.org