Re: [Geoserver-devel] Security issue in CSW, security filters are being ignored

2016-09-17 Thread Niels Charlier
Thanks, Andrea! On 17-09-16 11:56, Andrea Aime wrote: Since this last one is safer and less invasive on existing code I've merged it, and I'm backporting it to 2.9.x in order to get this fix in before the release Monday (to allow a full cycle of nightly build and CITE tests). Cheers Andrea

Re: [Geoserver-devel] Security issue in CSW, security filters are being ignored

2016-09-17 Thread Andrea Aime
Since this last one is safer and less invasive on existing code I've merged it, and I'm backporting it to 2.9.x in order to get this fix in before the release Monday (to allow a full cycle of nightly build and CITE tests). Cheers Andrea On Fri, Sep 16, 2016 at 3:53 PM, Andrea Aime wrote: > Hi,

Re: [Geoserver-devel] Security issue in CSW, security filters are being ignored

2016-09-16 Thread Andrea Aime
Hi, I actually also coded the "wrap the facade" path which has no interface breaking changes: https://github.com/geoserver/geoserver/pull/1823 The SecureCatalogFacade is not a pretty sight, but changes are otherwise much more contained Cheers Andrea On Fri, Sep 16, 2016 at 12:46 PM, Andrea Aim

Re: [Geoserver-devel] Security issue in CSW, security filters are being ignored

2016-09-16 Thread Andrea Aime
Ok, took a stab at it, pull request is here: https://github.com/geoserver/geoserver/pull/1822 Most of the options to alter the I've explored have some issues (including the chosen one): 1. Just adding the extra method with SortBy... breaks clients passing null as the sortyby, because the co

Re: [Geoserver-devel] Security issue in CSW, security filters are being ignored

2016-09-15 Thread Niels Charlier
Hi Andrea, As I can remember, the security leak was not done on purpose. I remember needing multiple SortBy's and being confused by the API. This security issue is likely an oversight on my behalf. The difference in signature between Catalog and CatalogFacade is not very logical/consistent.