Page History

Major bug fixes include:

• XMLUI security fixes:
  • [HIGH SEVERITY] The XMLUI "themes/" path is vulnerable to a full directory traversal. (DS-3094 - requires a JIRA account to access.) This means that ANY files on your system which are readable to the Tomcat user account may be publicly accessed via your DSpace website.
    • Reported by Virginia Tech
      
• JSPUI security fixes: 
  • [MEDIUM SEVERITY] The JSPUI "Edit News" feature (accessible to Administrators) can be used to view/edit ANY files which are readable to the Tomcat user account (DS-3063 - requires a JIRA account to access.)
    • Reported by CINECA
      
• REST fixes
  • Fixed the "/handle" endpoint (DS-2936)
  • REST webapp wasn't registering itself on startup (DS-2946)
• OAI fixes
  • Fixed a few incorrect URL encoding issue (DS-3050)
  • Fixed the broken "NOT" filter (DS-2820)
• Configuration Fixes
  
  • Fixed misspelling in dcterms registry (conformsTo) (DS-2998) 
  • Updated our default DataCite configurations to point at the updated DataCite test server (DS-2923)
• Other minor fixes
  • Broken SQL query in Item.findByMetadataFieldAuthority API method (DS-2517)
    
  • Mirage2:
  Minor fixes to the Mirage 2 XMLUI theme
  • Ensured printing the item page from doesn't include bitstream URLs (DS-2893)