Help Center

Menu

Funnelback patch 15.20.0.26

  • Released: 2020-03-03

  • Applies to: v15.20.0

  • Internal reference: RNDSUPPORT-3131, RNDSUPPORT-3139, RNDSUPPORT-3145, RNDSUPPORT-3140, RNDSUPPORT-3141

Description

  • RNDSUPPORT-3131 - Removes the screens for file-manager rule editing which could create security issues

  • RNDSUPPORT-3139 - Fixes an issue where support packages could contain unintended files

  • RNDSUPPORT-3145 - Fixes an issue where the running Funnelback jetty web server could retain permissions via supplemental groups after startup

  • RNDSUPPORT-3140 - Limits an administration CGI script to redirect only within the Funnelback administration interface as intended

  • RNDSUPPORT-3141 - Removes the unused administration debug.cgi script which reflected input parameters without proper escaping

Funnelback thanks Ron Schwarzmann and Dugald Shaw for discovering and reporting these issues.

Affected files

  • (RNDSUPPORT-3131) /conf/admin-ui.ini.default

  • (RNDSUPPORT-3131) /web/admin/delete-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/delete-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/edit-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/edit-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/save-folder.cgi

  • (RNDSUPPORT-3131) /web/admin/save-rules.cgi

  • (RNDSUPPORT-3131) /web/admin/show-fm-rules.cgi

  • (RNDSUPPORT-3139) /web/admin/download-support-package.cgi

  • (RNDSUPPORT-3145) tools/jetty/lib/setuid/libsetuid.so

  • (RNDSUPPORT-3145) tools/jetty/lib/setuid/libsetuid-linux.so

  • (RNDSUPPORT-3140) /web/admin/delayed-redirect.cgi

  • (RNDSUPPORT-3141) /web/admin/debug.cgi

Deployment

  • (Windows) Stop any tuning runs that are in progress

  • Stop the Jetty web server

  • Deploy the provided files on top of an existing install.

  • (15.20.0.2) Run $SEARCH_HOME/bin/setup/start_funnelback_on_boot.pl - Please note that this will cause Funnelback services to be restarted.

  • (15.20.0.2) On unix only, run chown -R search:search $SEARCH_HOME/databases/neo4j/ $SEARCH_HOME/log/neo4j as root to fix file ownership replacing search with your funnelback user’s username if you used a different one.

  • (15.20.0.22) Run $SEARCH_HOME/bin/setup/start_funnelback_on_boot.pl to regenerate service files from the templates. Please note that this will cause each Funnelback service to be restarted.

  • (15.20.0.22) Reboot the Funnelback server to ensure systemd picks up the changes to the service files

  • (15.20.0.2) Restart the Funnelback server to ensure any prior funnelback-graph service is terminated.

  • Start the Jetty web server

  • (15.20.0.3) Perform an update of knowledge graph on any applicable collections to ensure "mention" relationships that reference themselves are removed.

  • (15.20.0.7) As wcag was deprecated in version 15.12 it is recommended to switch to using its replacement by editing collection.cfg to have 'wcag.check=false', remove FAChecker from 'filter.classes=' and set 'accessibility-auditor.check=true'. The wcag check may be completely removed from future versions.

  • Start the Jetty web server if the server was not restarted.