Workarounds for CVE-2017-12629.

- Thanks to Jason Cooper for the patch.

solr.bat

@@ -80,7 +80,7 @@ if not "!%SOLR_PORT%!"=="!!" goto solrportset
 set SOLR_PORT=8080
 :solrportset
 
-call %SOLR_BIN%\solr.cmd %1 %SOLR_ADDITIONAL_START_OPTIONS% -p %SOLR_PORT% -s %SOLR_HOME% -m %SOLR_HEAP% -a "-Dsolr.log=%SOLR_LOGS_DIR% %SOLR_ADDITIONAL_JVM_OPTIONS%"
+call %SOLR_BIN%\solr.cmd %1 %SOLR_ADDITIONAL_START_OPTIONS% -p %SOLR_PORT% -s %SOLR_HOME% -m %SOLR_HEAP% -a "-Ddisable.configEdit=true -Dsolr.log=%SOLR_LOGS_DIR% %SOLR_ADDITIONAL_JVM_OPTIONS%"
 goto end
 
 :usage

solr.sh

@@ -81,4 +81,4 @@ then
 fi
 
 export SOLR_LOGS_DIR=$SOLR_LOGS_DIR
-"$SOLR_BIN/solr" "$1" ${SOLR_ADDITIONAL_START_OPTIONS} -p "$SOLR_PORT" -s "$SOLR_HOME" -m "$SOLR_HEAP" -a "-Dsolr.log=$SOLR_LOGS_DIR $SOLR_ADDITIONAL_JVM_OPTIONS"
+"$SOLR_BIN/solr" "$1" ${SOLR_ADDITIONAL_START_OPTIONS} -p "$SOLR_PORT" -s "$SOLR_HOME" -m "$SOLR_HEAP" -a "-Ddisable.configEdit=true -Dsolr.log=$SOLR_LOGS_DIR $SOLR_ADDITIONAL_JVM_OPTIONS"

solr/vufind/authority/conf/solrconfig.xml

@@ -550,7 +550,10 @@
   <queryResponseWriter name="xslt" class="org.apache.solr.response.XSLTResponseWriter">
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter> 
-    
+
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface --> 
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/biblio/conf/solrconfig.xml

@@ -707,6 +707,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter>
 
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface -->
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/reserves/conf/solrconfig.xml

@@ -555,6 +555,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter> 
     
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface --> 
   <admin>
     <defaultQuery>shakespeare</defaultQuery>

solr/vufind/website/conf/solrconfig.xml

@@ -644,6 +644,9 @@
     <int name="xsltCacheLifetimeSeconds">5</int>
   </queryResponseWriter>
 
+  <!-- Mitigate CVE-2017-12629 -->
+  <queryParser name="xmlparser" class="solr.ExtendedDismaxQParserPlugin"/>
+
   <!-- config for the admin interface -->
   <admin>
     <defaultQuery>shakespeare</defaultQuery>