Changeset 888

Timestamp:

Apr 16, 2011, 2:32:19 AM (15 years ago)

Author:

gav

Message:

Svn merge -r886:r887 trunk/ into branches/features/grailsUpgrade/.
Security fix for "Annotation based security is easy to bypass by adding ".html' to the URL", closes ticket #98.

File:

• branches/features/grailsUpgrade/grails-app/conf/Config.groovy (modified) (1 diff)

branches/features/grailsUpgrade/grails-app/conf/Config.groovy

@@ -10 +10 @@
 //    grails.config.locations << "file:" + System.properties["${appName}.config.location"]
 // }
-grails.mime.file.extensions = true // enables the parsing of file extensions from URLs into the request format
+
+// Set false due to acegi security issue.
+// See: http://jira.grails.org/browse/GPACEGI-41
+// See: http://www.gnumims.org/trac/ticket/98
+grails.mime.file.extensions = false // enables the parsing of file extensions from URLs into the request format
+
 grails.mime.types = [ html: ['text/html','application/xhtml+xml'],
                       xml: ['text/xml', 'application/xml'],