Re: Upgrading from 2.4.82 to 2.4.104

If you have an internal wiki, it doesn't really matter.  If it's  
public, I would recommend taking a look at the default templates to  
see what happened and what was fixed.

The security problems relate to XSS attacks, so as long as your  
template properly escapes everything before outputting, you should be  
fine.

/Janne

On 25 Sep 2007, at 23:26, Tim Koop wrote:

> Thanks Janne.  That did it.
>
> One more question.  We are using a customised template.  Are any  
> fixes for security vulnerabilities or extra features hidden in  
> those default template jsp files so we would have to modify our  
> template too, or can we just keep on using our 2.4.82 customized  
> template unmodified?
>
> Thanks.
>
> Tim Koop
>
>
>
>
> Janne Jalkanen wrote:
>>
>> Signature changed in 2.4.100 (it was expired).  Make sure you also  
>> copy jspwiki.jks to the right place.
>>
>> /Janne
>>
>> On 25 Sep 2007, at 22:58, Tim Koop wrote:
>>
>>> Hi.  I'm trying to upgrade from 2.4.82 to 2.4.104, but I'm  
>>> hitting a problem.
>>>
>>> According to the instructions, I can just copy over the new jar  
>>> files, the top-level jsp files, and the default template.  I  
>>> unzipped the new war file and copied over these things.  This is  
>>> what I copied: *.jsp, WEB-INF/lib/*.jar, and templates/default/*  
>>> recursively.
>>>
>>> But now nobody can log in.  I get the "Forbidden  Sorry, you are  
>>> not allowed to do that." page every time.  The log says this:
>>>
>>> 2007-09-25 19:46:08,349 [TP-Processor6] INFO  
>>> com.ecyrd.jspwiki.WikiServlet wiki:/wiki/page/Main wiki:https:// 
>>> {removed}/wiki/page/Main - Request for page: Main
>>> 2007-09-25 19:46:08,353 [TP-Processor6] INFO SecurityLog wiki:/ 
>>> wiki/page/Main wiki:https://{removed}/wiki/page/Main -  
>>> WikiSecurityEvent.LOGIN_AUTHENTICATED  
>>> [source=com.ecyrd.jspwiki.auth.AuthenticationManager@1c4f0f8,  
>>> princpal=org.apache.catalina.connector.CoyotePrincipal Brian,  
>>> target=com.ecyrd.jspwiki.WikiSession@1a7905e]
>>> 2007-09-25 19:46:08,377 [TP-Processor6] ERROR  
>>> com.ecyrd.jspwiki.WikiSession wiki:/wiki/page/Main wiki:https:// 
>>> {removed}/wiki/page/Main - Refresh principals failed because user  
>>> profile matching 'Brian' not found.
>>> 2007-09-25 19:46:08,383 [TP-Processor6] INFO  
>>> com.ecyrd.jspwiki.WikiContext wiki:/wiki/page/Main wiki:https:// 
>>> {removed}/wiki/page/Main - User Brian has no access - forbidden  
>>> (permission= 
>>> ("com.ecyrd.jspwiki.auth.permissions.PagePermission","wiki:Main","vi 
>>> ew"))
>>> 2007-09-25 19:46:24,035 [TP-Processor5] INFO  
>>> com.ecyrd.jspwiki.WikiServlet wiki:/wiki/page/Main wiki:https:// 
>>> {removed}/wiki/page/Main - Request for page: Main
>>>
>>> In JSPWiki.properties I'm using:
>>> jspwiki.authorizer =  
>>> com.ecyrd.jspwiki.auth.authorize.WebContainerAuthorizer
>>> jspwiki.groupdatabase =  
>>> com.ecyrd.jspwiki.auth.authorize.JDBCGroupDatabase
>>> jspwiki.userdatabase = com.ecyrd.jspwiki.auth.user.JDBCUserDatabase
>>>
>>> I'm using some custom filters.
>>>
>>>
>>> If I simply copy over and use the old (2.4.82) JSPWiki.jar file,  
>>> it all works fine, but if I use the new (2.4.104) JSPWiki.jar  
>>> file, I get the Forbidden message every time.
>>>
>>> Any ideas?
>>>
>>> Thanks a lot!
>>>
>>> -- 
>>> Tim Koop
>>> _______________________________________________
>>> This is the Jspwiki-users mailing list, in which we discuss the  
>>> stable release (even-numbered, 2.4.x, 2.6.x), and user-issues.  
>>> For development discussion, please join jspwiki-dev.
>>> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
>>> http://www.jspwiki.org/JSPWikiMailingList
>>
>> _______________________________________________
>> This is the Jspwiki-users mailing list, in which we discuss  
>> thestable release (even-numbered, 2.4.x, 2.6.x), and user- 
>> issues.For development discussion, please join jspwiki-dev.
>> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
>> http://www.jspwiki.org/JSPWikiMailingList
>>
> _______________________________________________
> This is the Jspwiki-users mailing list, in which we discuss the  
> stable release (even-numbered, 2.4.x, 2.6.x), and user-issues. For  
> development discussion, please join jspwiki-dev.
> http://ecyrd.com/cgi-bin/mailman/listinfo/jspwiki-users
> http://www.jspwiki.org/JSPWikiMailingList