Merge branch 'release-4.1'

solr.bat

@@ -80,7 +80,7 @@ if not "!%SOLR_PORT%!"=="!!" goto solrportset
 set SOLR_PORT=8080
 :solrportset
 
-call %SOLR_BIN%\solr.cmd %1 %SOLR_ADDITIONAL_START_OPTIONS% -p %SOLR_PORT% -s %SOLR_HOME% -m %SOLR_HEAP% -a "-Dsolr.log=%SOLR_LOGS_DIR% %SOLR_ADDITIONAL_JVM_OPTIONS%"
+call %SOLR_BIN%\solr.cmd %1 %SOLR_ADDITIONAL_START_OPTIONS% -p %SOLR_PORT% -s %SOLR_HOME% -m %SOLR_HEAP% -a "-Ddisable.configEdit=true -Dsolr.log=%SOLR_LOGS_DIR% %SOLR_ADDITIONAL_JVM_OPTIONS%"
 goto end
 
 :usage

solr.sh

@@ -81,4 +81,4 @@ then
 fi
 
 export SOLR_LOGS_DIR=$SOLR_LOGS_DIR
-"$SOLR_BIN/solr" "$1" ${SOLR_ADDITIONAL_START_OPTIONS} -p "$SOLR_PORT" -s "$SOLR_HOME" -m "$SOLR_HEAP" -a "-Dsolr.log=$SOLR_LOGS_DIR $SOLR_ADDITIONAL_JVM_OPTIONS"
+"$SOLR_BIN/solr" "$1" ${SOLR_ADDITIONAL_START_OPTIONS} -p "$SOLR_PORT" -s "$SOLR_HOME" -m "$SOLR_HEAP" -a "-Ddisable.configEdit=true -Dsolr.log=$SOLR_LOGS_DIR $SOLR_ADDITIONAL_JVM_OPTIONS"

solr/vufind/authority/conf/solrconfig.xml

@@ -550,7 +550,10 @@
   <queryResponseWriter name="xslt" class="org.apache.solr.response.XSLTResponseWriter">
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter> 
-    
+
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface --> 
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/biblio/conf/solrconfig.xml

@@ -707,6 +707,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter>
 
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface -->
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/reserves/conf/solrconfig.xml

@@ -555,6 +555,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter> 
     
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface --> 
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/website/conf/solrconfig.xml

@@ -644,6 +644,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter>
 
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface -->
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

themes/bootstrap3/js/record.js

@@ -212,6 +212,9 @@ function refreshTagList(_target, _loggedin) {
     });
   }
 }
+function refreshTagListCallback() {
+  refreshTagList(false, true);
+}
 
 function ajaxTagUpdate(_link, tag, _remove) {
   var link = _link || document;

themes/bootstrap3/templates/record/addtag.phtml

@@ -8,7 +8,7 @@
       . '<li class="active">' . $this->transEsc('Add Tag') . '</li>';
 ?>
 <h2><?=$this->transEsc('Add Tags') ?></h2>
-<form method="post" name="tagRecord" class="form-add-tag" data-lightbox-onclose="refreshTagList">
+<form method="post" name="tagRecord" class="form-add-tag" data-lightbox-onclose="refreshTagListCallback">
   <input type="hidden" name="submit" value="1" />
   <input type="hidden" name="id" value="<?=$this->escapeHtmlAttr($this->driver->getUniqueId())?>" />
   <input type="hidden" name="source" value="<?=$this->escapeHtmlAttr($this->driver->getSourceIdentifier())?>" />