Closed (fixed)
Project:
Apache Solr Search
Version:
6.x-1.x-dev
Component:
solrconfig.xml
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
18 Mar 2011 at 20:29 UTC
Updated:
30 Nov 2011 at 13:40 UTC
Jump to comment: Most recent file
Comments
Comment #1
pwolanin commentedWell, I actually liked better the explicit listing of allowed files, since there could be various unexpected conf files, backups, etc that should not be exposed, which is why I stayed with the (deprecated) handler.
Comment #2
jpmckinney commentedTrue, though deprecation isn't good long term. We can keep this here for now, and hope Solr allows whitelisting instead of only blacklisting.
Comment #3
jpmckinney commentedComment #4
jpmckinney commentedSee #799970: update README.txt and other docs w.r.t. required conf files.. Using gettableFiles can lead to frustration when setting up Solr.
Comment #5
pwolanin commentedSo, this doesn't seem to work to block a request to
http://localhost:8983/solr/admin/file/?file=xslt/luke.xsl
However, the xsl files are not listed in the admin interface.
Comment #6
jpmckinney commentedI was optimistic that Solr allowed blocking of directories, but it seems it requires the listing of each file explicitly.
Comment #7
pwolanin commentedThe xsl files are not sensitive, I was mostly trying to avoid confusion in the UI by listing stuff a typical admin would not need to see.
So, if the files are not listed, maybe it doesn't matter.
Comment #8
jpmckinney commentedNew patch in any case to block requests to xslt files.
Comment #9
nick_vhI guess this update does require a notice so that the drupal administrator knows that solrconfig.xml has changed? Can we somehow see if the version is different and notify them?
Comment #10
jpmckinney commentedSince when do we notify administrators that the xml files have changed? The patch just needs to be re-rolled to change the version at the top of the file.
Comment #11
nick_vhAlright, didn't know the history or impact of these changes.
Marking as needs review
Comment #12
nick_vhI was testing this patch and found out that apachesolr_config_files_overview doesn't work with solr 3.4
Have to test if it is the same behavior with solr 1.4 but I expect not.
In solr 3.4 the files table or response is being answered as an json_encoded string.
Comment #13
nick_vhSo indeed
Solr 1.4 :
<?xml version="1.0" encoding="UTF-8"?> 01913102010-06-17T17:07:48Z31142010-06-17T17:07:48Z1872011-11-14T11:29:27Z267552011-11-14T11:29:27Z306852011-11-14T11:29:27Z12292010-06-17T17:07:48Z11632010-06-17T17:07:48Z
Solr 3.4:
{"responseHeader":{"status":0,"QTime":25},"files":{"elevate.xml":{"size":1274,"modified":"2011-09-07T17:11:33Z"},"mapping-ISOLatin1Accent.txt":{"size":2868,"modified":"2011-09-07T17:11:33Z"},"protwords.txt":{"size":187,"modified":"2011-10-01T03:19:17Z"},"schema.xml":{"size":28104,"modified":"2011-10-01T03:19:17Z"},"solrconfig.xml":{"size":30703,"modified":"2011-10-27T14:04:22Z"},"stopwords.txt":{"size":781,"modified":"2011-09-07T17:11:33Z"},"synonyms.txt":{"size":1133,"modified":"2011-09-07T17:11:33Z"}}}
Comment #14
nick_vhAnd in a followup
To know if we are running solr 1.4 or 3.4 we need to include the following handler
Then we can retrieve the following info :
Will make a proof of concept code
Comment #15
nick_vhThis patch supports multiple versions of solr (1.4 and 3.4)
Comment #16
nick_vhComment #17
nick_vhClean patch that does not take those whitespaces into account
Comment #18
nick_vhOne more fix
Comment #19
nick_vhAnd using a table, much prettier and less clunky :)
Comment #20
nick_vhChanged the error text if there are no files found
Comment #21
pwolanin commentedneed wt=xml in the servlet request
Comment #22
nick_vhThis patch should be much better.
Still formats it in a table and does a better job checking if the value of the xml is the expected value. Directories are not listed.
Comment #23
nick_vhSmaller and leaner
Comment #24
nick_vhTested extensively on both Apache Solr 1.4 and 3.4
Committed
Thanks!
Comment #25
pwolanin commentedWould seem like the wt=xml part at least needs to be backported to 6.x?
Comment #26
nick_vhThis might do it for d6
Comment #27
pwolanin commentedYes, let's test it, but I think that's all that's required.
Comment #28
nick_vhTested on D6 and works for solr 1.4 and 3.4
https://img.skitch.com/20111116-c9fe4ceu4jn5p4h9n27q2fb3qm.jpg (3.4)
https://img.skitch.com/20111116-895efkk7d642ew6pkgn18wwpi5.jpg (1.4)
Comment #29
nick_vhAnd committed for 6.x also