Funnelback 15.14 patches

15.14.0.40

Fixes an issue where sessions are not terminated on logout events triggered by perl pages.

15.14.0.38

Removes the screens for file-manager rule editing which could create security issues

15.14.0.38

Fixes an issue where the running Funnelback jetty web server could retain permissions via supplemental groups after startup

15.14.0.38

Removes the unused administration debug.cgi script which reflected input parameters without proper escaping

15.14.0.37

Adds method 'getEffectiveExtraSearchName()' to the search transaction which gets the name of the extra search this search should be considered to be under. The result of this should be used when modifying a particular extra search. As Funnelback may create extra searches under an existing search, for example for faceted navigation, this could be used to work out if the search transaction should be modified.

15.14.0.35

Prevent XSS AngularJS sandbox bypassing injection in Freemarker templates by inserting zero-width whitespace between consecutive open-curly-brackets.

15.14.0.33

Improve the performance of the Accessibility Auditor interface by requesting less data.

15.14.0.33

Fixes an issue where the Accessibility Auditor dashboard would not generate the thumbnail screenshots for each domain.

15.14.0.31

Fixes an issue where large (>2GB) index.dt files would cause padre-gs to fail when setting gscopes.

15.14.0.29

Fixes an issue where recording Accessibility Auditor details would fail during the swap views step if the server is in read-only mode.

15.14.0.28

Fixes a bug where query processing may fail when given dates in the query. Failure would always occur when the date was invalid.

15.14.0.27

The default timeout for 'push.scheduler.delay-between-meta-dependencies-runs' has been increased to '1200' (20 minutes). This has been increased to reduce the frequency at which Accessibility Auditor historical data is recorded. This option will need to be overridden if meta collections containing push collections need a smaller delay in updating the spelling index and auto completion.

15.14.0.26

Fixes a bug where a 'NullPointerException' may be thrown when a faceted navigation extra search fails or does not run.

15.14.0.25

Fixes a bug where queries may not return when instant updates include URLs that contain ampersands.

15.14.0.23

Fixes a bug where 'FineTune' may crash when 'query_processor_options' is longer than '1000' bytes.

15.14.0.21

Fixes a bug where users that did not have access to all collections would not be given access to the collection they just created.

15.14.0.20

Fixes security issues where:

Please ensure any custom form-not-found.ftl templates in collections are updated to perform correct escaping if they were derived from the previously vulnerable form-not-found.default.ftl.

Please ensure that any customised value for the global default_url_renderer.permitted_url_pattern setting in global.cfg prevents access to file:// URLs.

15.14.0.18

Fixes a bug where the crawler would not correctly decode links in HTML, XML and plain text documents.

15.14.0.18

Fixes support for sort mode '3' in query completion, allowing 'alpha' to be respected.

15.14.0.16

Provides additional metadata for twitter records specifying if a tweet is a reply and to what it is a reply to. This is made available in the XML under 'isReply', 'inReplyToScreenName', 'inReplyToStatusId', 'inReplyToUserId' and 'inReplyToUrl'.

15.14.0.15

Adds an experimental DLS plugin called "secBoolExpr" which is able to evaluate lockstrings which are boolean expression. For example, a lockstring where the user must have both B and C or A can be represented as A,(B AND C) or A | (B&C). This lockstring is evaluated as a boolean expression where the user keys are what is true in the expression. For example, if the user had "B" and "C" then they would be able to view that document. To enable the plugin set in collection.cfg "security.earlybinding.locks-keys-matcher.name=secBoolExpr" and set "-lock_string_mod_mode=raw" on the indexer.

15.14.0.13

Fixes an issue with SAML authentication where users who did not have access to the funnelback_documentation collection were unable to log out.

15.14.0.13

Stops the same sitemap.xml file from being processed multiple times on different threads.

15.14.0.12

Fixes an issue where the admin API crawler debug utilities did not respect the 'crawler.form_interaction_file' collection.cfg option. It always assumed a default value of 'form_interaction.cfg'.

15.14.0.10

Improves the internal re-filter program.

15.14.0.9

Removes a complexity limit in contextual navigation which applied to the entire query rather than only to the terms relevant for contextual navigation. This allows contextual navigation to work on complex queries, such as those generated by facets.

15.14.0.7

Fixes an issue where two jars provided conflicting classes with the same package name; this results in errors if a filter or groovy script used the 'org.json' package. This patch fixes the issue by forcing the use of 'json-20160810.jar' (org.json:json), which provides everything 'json-1.8.jar' (com.tdunning:json) did and more. See https://issues.apache.org/jira/browse/TIKA-2556 for further details about the change.

15.14.0.5

Provides a collection.cfg setting (crawler.send-http-basic-credentials-without-challenge) to restore older web-crawler behaviour of sending HTTP Basic authentication details without waiting for a 401 challenge from the web server.

This patch includes a default setting to default to the old behaviour.

15.14.0.3

Fixes a bug for scheduled updates where the 'schedule.incremental_crawl_ratio' parameter was not being respected.

15.14.0.2

Makes the web crawler pre-crawl form interaction accept login forms which are served with an HTTP 401 or 403 code.

15.14.0.1

Fixes query biased summaries so that it doesn’t show multiple dots when the original content contains non breaking spaces as the only value within "p" tags.