Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-10-26 08:06:09 +01:00
Code Issues Packages Projects Releases Activity

Deactivate shiro's blockTraversal filter

Browse Source 
Because it breaks our branch encodings

Committed-by: Florian Scholdei <florian.scholdei@cloudogu.com>
This commit is contained in:
Eduard Heimbuch
2023-08-02 15:27:09 +02:00
parent b22722cbed
commit 8cafeefc74
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
gradle/changelog/shiro_traversal_filter.yaml Normal file
View File

@@ -0,0 +1,2 @@
- type: fixed
description: Deactivate Shiro's new `blockTraversal` check in their `InvalidRequestFilter`

1
scm-webapp/src/main/java/sonia/scm/lifecycle/modules/ScmSecurityModule.java
View File

@@ -121,6 +121,7 @@ public class ScmSecurityModule extends ShiroWebModule
// do not block non ascii character,
// because this would exclude languages which are non ascii based
bindConstant().annotatedWith(Names.named("shiro.blockNonAscii")).to(false);
bindConstant().annotatedWith(Names.named("shiro.blockTraversal")).to(false);
// disable access to mustache resources
addFilterChain("/**.mustache", filterConfig(ROLES, "nobody"));