Skip to content
Snippets Groups Projects

Set webgui browser off by default

Merged Eoin Clerkin requested to merge e.clerkin/cbmroot:security-fix into master
All threads resolved!

via alias. Addresses recent cern root issue.

Possibly option for a solution.

As introduced by @f.uhlig in today's software and discussed by @p.-a.loizeau and @m.shiroya

See https://indico.gsi.de/event/18677/

See https://root.cern/about/security/#2023-11-26-open-port-for-control-of-web-gui-allows-read-and-write-access-to-file-system

Merge request reports

Merge request pipeline #26072 passed

Merge request pipeline passed for 78e1f39a

Merged by Florian UhligFlorian Uhlig 1 year ago (Dec 1, 2023 2:46pm UTC)

Loading

Pipeline #26073 passed

Pipeline passed for 78e1f39a on master

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Eoin Clerkin added 1 commit

    added 1 commit

    • 6bf0bede - Set webgui browser off by default

    Compare with previous version

  • Eoin Clerkin resolved all threads

    resolved all threads

  • Eoin Clerkin added 2 commits

    added 2 commits

    • 776c31cc - 1 commit from branch computing:master
    • bfa912ba - Set webgui browser off by default

    Compare with previous version

  • Pierre-Alain Loizeau resolved all threads

    resolved all threads

  • Pierre-Alain Loizeau approved this merge request

    approved this merge request

  • added 2 commits

    • 7e3e340f - 1 commit from branch computing:master
    • 5fe600c8 - Set webgui browser off by default

    Compare with previous version

  • Pierre-Alain Loizeau changed milestone to %OCT23

    changed milestone to %OCT23

  • added 3 commits

    Compare with previous version

    • Resolved by Pierre-Alain Loizeau

      Although most of us, including me, have never really used the web based TBrowser, some of our cbmroot user-base may, and removing this may annoy them.

      Therefore, I think we should inform them how to disable the alias if they want, and perhaps this can be but as a flagged option of the config.

      Depending on how serious this security flaw is, I think this should be addressed by us and can be via a commit like this.

      @f.uhlig I would ask that you do this in addition at the FairRoot level. Two aliases will just overwrite each other.

  • Florian Uhlig resolved all threads

    resolved all threads

  • Florian Uhlig added 3 commits

    added 3 commits

    Compare with previous version

  • Florian Uhlig enabled an automatic merge when the pipeline for 78e1f39a succeeds

    enabled an automatic merge when the pipeline for 78e1f39a succeeds

  • merged

  • Please register or sign in to reply
    Loading