Repository navigation
Security
The web application (webapp) has to have writable access to the data root as certain RESTful APIs need to be able to modify the data such as configuration, index data, suggester data etc. It does not have to have writable access to the source root, though.
The API token used for indexer-webapp communication is also used to configure webapp settings. There is no notion of administrative access besides the discretionary access controls enforced by the operating system, i.e. if anyone is able to read a file which contains the token, he will be able to reconfigure the webapp.
See the 'Security considerations' sections in the following pages:
- https://github.com/oracle/opengrok/wiki/How-to-setup-OpenGrok
- https://github.com/oracle/opengrok/wiki/Authorization
If you believe you have found a security vulnerability, please submit a report to secalert_us@oracle.com preferably with a proof of concept. Please refer to Reporting Vulnerabilities for additional information including our public encryption key for secure email. We ask that you do not contact project contributors directly or through other channels about a report.
