Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Config] Fix default DownloadPath in ConfigSettings #9464

Closed
jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Closed

[Config] Fix default DownloadPath in ConfigSettings #9464

jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Assignees
@kongtiaowang
Labels
Category: Bug PR or issue that aims to report or fix a bug Category: Security PR or issue that aims to improve security Priority: High PR or issue should be prioritised over others for review and testing
Milestone
27.0.0

Comments

@jeffersoncasimir
Copy link
Contributor

jeffersoncasimir commented Nov 12, 2024 •
edited
Loading

The %LORISROOT% variable is being used as the default DownloadPath, which can be a potential a security vulnerability if unchanged.

https://github.com/aces/Loris/blob/4860adfa212a3301baed2b9e775e099abec01b7b/SQL/0000-00-03-ConfigTables.sql#L214C1-L214C109

PR to be sent to 26.
@jeffersoncasimir jeffersoncasimir added the Category: Bug PR or issue that aims to report or fix a bug label Nov 12, 2024
@kongtiaowang kongtiaowang mentioned this issue Nov 12, 2024
Merged
@driusan driusan added the Category: Security PR or issue that aims to improve security label Jan 21, 2025
@jeffersoncasimir jeffersoncasimir added the Priority: High PR or issue should be prioritised over others for review and testing label Feb 3, 2025
@driusan driusan added this to the 27.0.0 milestone Feb 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kongtiaowang kongtiaowang

Labels
Category: Bug PR or issue that aims to report or fix a bug Category: Security PR or issue that aims to improve security Priority: High PR or issue should be prioritised over others for review and testing
Projects
None yet
Milestone
27.0.0
Development

No branches or pull requests
3 participants
@driusan @kongtiaowang @jeffersoncasimir