This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from a9a3237fe9 Improved: Update allowed local file paths to enhance
security
new eb6c54aba6 Reverted: commit 6e8d8620ac
new 23bac92261 Fixed: Enhance XML processing security by disabling
external entity resolution across multiple classes
new 86c6f3a4f4 Fixed: Wrap setAttribute(ACCESS_EXTERNAL_DTD, ...) calls to
catch IllegalArgumentException thrown by older versions of Xalan/Saxon that
predate JAXP 1.5
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../thirdparty/eway/GatewayResponse.java | 4 +--
.../java/org/apache/ofbiz/base/util/UtilHtml.java | 2 ++
.../java/org/apache/ofbiz/base/util/UtilXml.java | 21 ++++++++++++-
.../ofbiz/base/util/string/UelFunctions.java | 10 +++++++
.../ofbiz/base/util/template/XslTransform.java | 12 ++++++--
.../ofbiz/entity/serialize/XmlSerializer.java | 34 +++++++++++++++++-----
.../apache/ofbiz/entity/util/EntitySaxReader.java | 9 +++++-
.../org/apache/ofbiz/minilang/MiniLangUtil.java | 8 +++++
.../org/apache/ofbiz/security/SecuredUpload.java | 4 +++
.../org/apache/ofbiz/service/ModelService.java | 2 ++
.../ofbiz/service/engine/SOAPClientEngine.java | 5 +++-
.../ofbiz/webapp/event/SOAPEventHandler.java | 10 +++++--
.../apache/ofbiz/webapp/view/ApacheFopWorker.java | 8 +++++
.../apache/ofbiz/webtools/WebToolsServices.java | 2 ++
14 files changed, 114 insertions(+), 17 deletions(-)
