Hi Ingo,

You don't need to use

./gradlew "ofbiz start"

./gradlew ofbiz
is enough and does not generate zip/tar.

This said I'm currently working on a feature that was lost when common-theme 
was put in. Fortunately tt was then documented by these FIXMEs
#FIXME the image server path need to be moved on runtime
#FIXME the image management path need to be moved on runtime

The idea is to not have the images under OFBiz tree but in a specific location 
unrelated to OFBiz.

I'm actually also working on this for security reason. It's a NSA 
recommendation*:

   <<Officials explained that web applications should not be given permissions 
to write directly to a web accessible directory or modify web
   accessible code.
   “Attackers are unable to upload a web shell to a vulnerable application if 
the web server blocks access to the web accessible directory,”
   according to the guidance. “To preserve functionality, some web applications 
require configuration changes to save uploads to a non-web accessible
   area.”>>

“To preserve functionality, some web applications require configuration changes 
to save uploads to a non-web accessible area.” That's exactly what we lost with 
common-theme. Fortunately it was documented and I stumbled upon it while 
working on related security issues.

Having images, and at large static files, in a specific location can also allow 
to speed things...


HTH

Jacques
*https://healthitsecurity.com/news/nsa-shares-guide-to-web-shell-malware-vulnerabilities-mitigation


Le 07/02/2022 à 17:56, Ingo Wolfmayr a écrit :
Hi everybody,

I have a question about building ofbiz. In previous versions for example 17.12 
I had the following process:

./gradlew build (build the project and see if everything is fine)
./gradlew "ofbiz start"

Now I am working with the current trunk and when I start ./gradlew build it starts 
"disttar" and generates a .tar and a .zip. As I have lots of images in a project it uses 
lots of disk space and time. Is my process wrong? Is there "correct" way of how it should 
be done?

Thanks for every hint.

Best regards,
Ingo

Reply via email to