Funnelback patch 15.10.0.40

  • Released: 2020-03-03

  • Applies to: v15.10.0

  • Internal reference: RNDSUPPORT-3131, RNDSUPPORT-3139, RNDSUPPORT-3145, RNDSUPPORT-3140, RNDSUPPORT-3141

Description

  • RNDSUPPORT-3131 - Removes the screens for file-manager rule editing which could create security issues

  • RNDSUPPORT-3139 - Fixes an issue where support packages could contain unintended files

  • RNDSUPPORT-3145 - Fixes an issue where the running Funnelback jetty web server could retain permissions via supplemental groups after startup

  • RNDSUPPORT-3140 - Limits an administration CGI script to redirect only within the Funnelback administration interface as intended

  • RNDSUPPORT-3141 - Removes the unused administration debug.cgi script which reflected input parameters without proper escaping

Funnelback thanks Ron Schwarzmann and Dugald Shaw for discovering and reporting these issues.

Affected files

  • (RNDSUPPORT-3131) /conf/admin-ui.ini.default

  • (RNDSUPPORT-3131) /web/admin/delete-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/delete-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/edit-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/edit-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/save-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/save-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/show-fm-rules.cgi

  • (RNDSUPPORT-3139) /web/admin/download-support-package.cgi

  • (RNDSUPPORT-3145) tools/jetty/lib/setuid/libsetuid.so

  • (RNDSUPPORT-3145) tools/jetty/lib/setuid/libsetuid-linux.so

  • (RNDSUPPORT-3140) /web/admin/delayed-redirect.cgi

  • (RNDSUPPORT-3141) /web/admin/debug.cgi

Deployment

  • (Windows) Stop currently running crawls.

  • Stop the Jetty web server and the Funnelback daemon.

  • If bin/delete-collection.pl is called directly on the command line, take note of the perl referenced in the #! line.

  • Deploy the provided files on top of an existing install, backing up all replaced files.

  • If bin/delete-collection.pl is called directly on the command line, update the perl referenced in the #! line.

  • To support extended tweets, add "cb.setTweetModeExtended(true);" after the "ConfigurationBuilder cb = new ConfigurationBuilder();" line in the twitter custom_gather.groovy script.

  • Start the Jetty web server and the Funnelback daemon.

  • (15.10.0.32) The conf/<collection>/custom_gather.groovy of each Facebook collection that are failing to update due to Facebook API changes should be updated to have the content provided in share/custom_collection_templates/custom_gather.groovy.facebook. The customer will need to provide a never-expiring page access token to replace the app access token.

  • (15.10.0.8) If the installation has Facebook collections, the Version given to the DefaultFacebookClient should be changed to Version.Latest e.g. new DefaultFacebookClient(Version.LATEST).

  • (Windows) Start crawls as needed.

  • Collections suffering from the issue with instant updates and external metadata will need to be updated before instant updates will work.