This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release22.01
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/release22.01 by this push:
new 093400e85 Fixed: Ensure that the SameSite attribute is set to 'strict'
for all cookies. (CVE-2019-0235) (OFBIZ-11470)
093400e85 is described below
commit 093400e8589d73a99f17c24794b6a7ef0ec83254
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Fri Sep 23 09:21:39 2022 +0200
Fixed: Ensure that the SameSite attribute is set to 'strict' for all
cookies. (CVE-2019-0235) (OFBIZ-11470)
I noticed while working on OFBIZ-11791 and after checking (it was 2 years
ago)
that I did not put the SameSiteFilter in ecomseo web.xml file. I think it's
because I thought that ecomseo is duplicating ecommerce. But I forgot that
it's
not the case for the web.xml file
---
ecommerce/webapp/ecomseo/WEB-INF/web.xml | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/ecommerce/webapp/ecomseo/WEB-INF/web.xml
b/ecommerce/webapp/ecomseo/WEB-INF/web.xml
index 4bdb63835..d50eee88b 100644
--- a/ecommerce/webapp/ecomseo/WEB-INF/web.xml
+++ b/ecommerce/webapp/ecomseo/WEB-INF/web.xml
@@ -86,6 +86,11 @@ under the License.
<param-value>/error:/control:/products:/select:/index.html:/index.jsp:/robots.txt:/default.html:/default.jsp:/images</param-value>
</init-param>
</filter>
+ <filter>
+ <display-name>SameSiteFilter</display-name>
+ <filter-name>SameSiteFilter</filter-name>
+
<filter-class>org.apache.ofbiz.webapp.control.SameSiteFilter</filter-class>
+ </filter>
<filter-mapping>
<filter-name>ContextFilter</filter-name>
<url-pattern>/*</url-pattern>
@@ -102,7 +107,10 @@ under the License.
<filter-name>SeoContextFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
-
+ <filter-mapping>
+ <filter-name>SameSiteFilter</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
<listener><listener-class>org.apache.ofbiz.webapp.control.ControlEventListener</listener-class></listener>
<!-- NOTE: not all app servers support mounting implementations of the
HttpSessionActivationListener interface -->
<!--
<listener><listener-class>org.apache.ofbiz.webapp.control.ControlActivationEventListener</listener-class></listener>
-->
