Funnelback 15.16 patches
Patches
| Type | Release version | Description |
|---|---|---|
3 Bug fixes |
Upgrades log4j2 to version 2.16 to fix the security vulnerability where log4j2 JNDI features do not protect against attacker-controlled LDAP and other JNDI related endpoints. |
|
3 Bug fixes |
Removes the screens for file-manager rule editing which could create security issues |
|
3 Bug fixes |
Fixes an issue where support packages could contain unintended files |
|
3 Bug fixes |
Fixes an issue where the running Funnelback jetty web server could retain permissions via supplemental groups after startup |
|
3 Bug fixes |
Limits an administration CGI script to redirect only within the Funnelback administration interface as intended |
|
3 Bug fixes |
Removes the unused administration debug.cgi script which reflected input parameters without proper escaping |
|
3 Bug fixes |
Improve the performance of the Accessibility Auditor interface by requesting less data. |
|
3 Bug fixes |
Fixes an issue where some of the text on the Accessibility Auditor dashboard was showing out of date information. |
|
3 Bug fixes |
Fixes an issue where the Accessibility Auditor dashboard would not generate the thumbnail screenshots for each domain. |
|
3 Bug fixes |
Improves the query response time when sorting. |
|
3 Bug fixes |
Fixes an issue where large (>2GB) index.dt files would cause padre-gs to fail when setting gscopes. |
|
3 Bug fixes |
Fixes an issue where jetty would terminate on invalid 'index.autoc' (query completion) files. |
|
3 Bug fixes |
Fixes an issue that prevents scheduled tasks from appearing in the Administration interface on Windows Server 2016. |
|
3 Bug fixes |
Fixes an issue where recording Accessibility Auditor details would fail during the swap views step if the server is in read-only mode. |
|
3 Bug fixes |
Fixes an issue where swap-views.pl did not clear the redis state before running the pipeline. |
|
3 Bug fixes |
Improves the Accessibility Auditor historical data storage. The data is stored in less space while also being significantly faster when storing and retrieving data. The Accessibility Auditor historical data APIs are also improved to reduce the amount of memory needed to help reduce the chance of 'OutOfMemoryError' exceptions from being thrown. The Accessibility Auditor historical data will be automatically moved to the new storage format when Jetty is restarted (one collection at a time) or on the first Accessibility Auditor historical data API request. |
|
3 Bug fixes |
The default timeout for 'push.scheduler.delay-between-meta-dependencies-runs' has been increased to '1200' (20 minutes). This has been increased to reduce the frequency at which Accessibility Auditor historical data is recorded. This option will need to be overridden if meta collections containing push collections need a smaller delay in updating the spelling index and auto completion. |
|
3 Bug fixes |
Fixes a bug where queries may not return when instant updates include URLs that contain ampersands. |
|
3 Bug fixes |
Prevents creation of objects within Freemarker template files to ensure that template editors can not cause external code to be executed. |
|
3 Bug fixes |
Fixes a bug where 'FineTune' may crash when 'query_processor_options' is longer than '1000' bytes. |
|
3 Bug fixes |
Push slaves will now actively pull down merge/vacuumed generations, rather than waiting for commits to trigger this. This can help solve problems where the slaves will not reduce the number of generations or re-indexes are not pulled down by the slaves. |
|
3 Bug fixes |
Fixes security issues where:
Please ensure any custom form-not-found.ftl templates in collections are updated to perform correct escaping if they were derived from the previously vulnerable form-not-found.default.ftl. Please ensure that any customised value for the global |
|
3 Bug fixes |
Fixes a bug where the crawler would not correctly decode links in HTML, XML and plain text documents. |
|
3 Bug fixes |
Improves the performance of the directory gatherer. |
|
3 Bug fixes |
Fixes support for sort mode '3' in query completion, allowing 'alpha' to be respected. |
|
3 Bug fixes |
|
|
3 Bug fixes |
Provides additional metadata for twitter records specifying if a tweet is a reply and to what it is a reply to. This is made available in the XML under 'isReply', 'inReplyToScreenName', 'inReplyToStatusId', 'inReplyToUserId' and 'inReplyToUrl'. |
|
3 Bug fixes |
Adds an option to padre-iw to allow control of how the lock string should be modified. The option is "-lock_string_mod_mode=[legacy raw]". By default it is set to "legacy" and that keeps the current behaviour of modifying the lockstring. The "raw" option results in padre-iw not altering the lock string; leaving in white space, new lines and commas. |
|
3 Bug fixes |
Adds an experimental DLS plugin called "secBoolExpr" which is able to evaluate lockstrings which are boolean expression. For example, a lockstring where the user must have both B and C or A can be represented as |
|
3 Bug fixes |
The default Facebook crawler requested information that required the page to be created by the same user that provided the application access token. The |
|
3 Bug fixes |
Fixes an issue with SAML authentication where users who did not have access to the funnelback_documentation collection were unable to log out. |
|
3 Bug fixes |
Fixes an issue with SAML authentication where some browsers would fail to redirect users completely after login. |
|
3 Bug fixes |
Updates error messaging in the task queue when SAML authentication is enabled. |
|
3 Bug fixes |
Updates product documentation references to unreleased features. |
|
3 Bug fixes |
Stops the same sitemap.xml file from being processed multiple times on different threads. |