Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Config] Fix default DownloadPath in ConfigSettings #9464

Open
jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Open

[Config] Fix default DownloadPath in ConfigSettings #9464

jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Assignees
@kongtiaowang
Labels
Category: Bug PR or issue that aims to report or fix a bug Category: Security PR or issue that aims to improve security

Comments

@jeffersoncasimir
Copy link
Contributor

jeffersoncasimir commented Nov 12, 2024 •
edited
Loading

The %LORISROOT% variable is being used as the default DownloadPath, which can be a potential a security vulnerability if unchanged.

https://github.com/aces/Loris/blob/4860adfa212a3301baed2b9e775e099abec01b7b/SQL/0000-00-03-ConfigTables.sql#L214C1-L214C109

PR to be sent to 26.
@jeffersoncasimir jeffersoncasimir added the Category: Bug PR or issue that aims to report or fix a bug label Nov 12, 2024
@kongtiaowang kongtiaowang mentioned this issue Nov 12, 2024
Merged
driusan pushed a commit that referenced this issue Nov 14, 2024
@kongtiaowang
[SQL] remove DownloadPath from sql files (#9467)
4790fb9 
Fixes #9464
@driusan driusan added the Category: Security PR or issue that aims to improve security label Jan 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kongtiaowang kongtiaowang

Labels
Category: Bug PR or issue that aims to report or fix a bug Category: Security PR or issue that aims to improve security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@driusan @kongtiaowang @jeffersoncasimir