Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Config] Fix default DownloadPath in ConfigSettings #9464

Open
jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Open

[Config] Fix default DownloadPath in ConfigSettings #9464

jeffersoncasimir opened this issue Nov 12, 2024 · 0 comments
Assignees
@kongtiaowang
Labels
Bug PR or issue introducing/requiring bug fixes (not mutually exclusive with the Feature label)

Comments

@jeffersoncasimir
Copy link
Contributor

jeffersoncasimir commented Nov 12, 2024 •
edited
Loading

The %LORISROOT% variable is being used as the default DownloadPath, which can be a potential a security vulnerability if unchanged.

https://github.com/aces/Loris/blob/4860adfa212a3301baed2b9e775e099abec01b7b/SQL/0000-00-03-ConfigTables.sql#L214C1-L214C109

PR to be sent to 26.
@jeffersoncasimir jeffersoncasimir added the Bug PR or issue introducing/requiring bug fixes (not mutually exclusive with the Feature label) label Nov 12, 2024
@kongtiaowang kongtiaowang mentioned this issue Nov 12, 2024
Merged
driusan pushed a commit that referenced this issue Nov 14, 2024
@kongtiaowang
[SQL] remove DownloadPath from sql files (#9467)
4790fb9 
Fixes #9464
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kongtiaowang kongtiaowang

Labels
Bug PR or issue introducing/requiring bug fixes (not mutually exclusive with the Feature label)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@kongtiaowang @jeffersoncasimir