[ https://issues.apache.org/jira/browse/SOLR-16781?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jason Gerlowski resolved SOLR-16781. ------------------------------------ Fix Version/s: 9.8 Resolution: Fixed Alright, thanks all for the review - closing this out. Fix Version will be 9.8 (as the first version with <lib> disabled by default) and 10.0 (as the first version with <lib> gone altogether). > Remove <lib> directives from Solr > --------------------------------- > > Key: SOLR-16781 > URL: https://issues.apache.org/jira/browse/SOLR-16781 > Project: Solr > Issue Type: Improvement > Reporter: Ishan Chattopadhyaya > Assignee: Jason Gerlowski > Priority: Blocker > Labels: pull-request-available > Fix For: main (10.0), 9.8 > > Attachments: SOLR-16781-1.patch, SOLR-16781-2.patch, SOLR-16781.patch > > Time Spent: 2h 50m > Remaining Estimate: 0h > > <lib> directives in solrconfig.xml used to be recommended way for including > additional jar files to the classpath for a particular collection or > collections. > For context: This feature required complex handling of "trusted" vs > "non-trusted" configsets in configset upload API to keep Solr secure (i.e. to > stop RCE attacks for non-authentication enabled deployments). This security > feature also broke down recently due to a bug in Schema designer (SOLR-16777). > Supported alternatives exist that are safer: > * user can add the jar files to Solr's classpath > * use packages to use custom jars per collection > In the light of these, there's no need to continue to support the <lib> > directive going forward. > I propose to remove the <lib> directives handling and functionality through > this issue. -- This message was sent by Atlassian Jira (v8.20.10#820010) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org For additional commands, e-mail: issues-h...@solr.apache.org