Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

BoxLang: Our new JVM Dynamic Language made by Ortus! Check it out: https://www.boxlang.io

Add Testbox runner to sensitive paths in production profile

Description

When CommandBox is in production profile and has web.blockSensitivePaths enabled, also block these

/tests/runner.cfm /testbox/system/runners/HTMLRunner.cfm

as those paths can be exploitable in older versions of TestBox and should not be visible on a server installation. The web.blockSensitivePaths setting is on by default even for development profile, but these paths will only be blocked if blockSensitivePaths is enabled AND the profile is production.

Activity

Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Fix versions

Priority

Sentry

Created November 30, 2020 at 8:30 PM
Updated December 16, 2020 at 6:06 AM
Resolved November 30, 2020 at 8:31 PM

Flag notifications