PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1331

Open

milanmajchrak wants to merge 18 commits into

customer/palo-dockerfrom

palo-docker-security-patches-7.6.7

Commits on Jun 11, 2026

ORE aggregated resource URI validation

kshepherd
authored and
milanmajchrak
committed
Velocity and template safety for Email and LDN messages

kshepherd
authored and
milanmajchrak
committed
Better null checking in allowed config props

kshepherd
authored and
milanmajchrak
committed
Access configurationService at runtime, not rely on class setup

kshepherd
authored and
milanmajchrak
committed
Remove strict mode Velocity engine configuration (allow nulls)

kshepherd
authored and
milanmajchrak
committed
Filter requests for JSPs or traversal

kshepherd
authored and
milanmajchrak
committed
Add additional logging to GlobalRequestSecurityFilter

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Update sitemap traversal test expectations

kshepherd
authored and
milanmajchrak
committed
Backport GlobalRequestSecurityFilter for javax

kshepherd
authored and
milanmajchrak
committed
Add secure file access methods

kshepherd
authored and
milanmajchrak
committed
Backport Curation I/O using secure file access

kshepherd
authored and
milanmajchrak
committed
Curation config support for allowed base paths

kshepherd
authored and
milanmajchrak
committed
Move curation -r reporter param to CLI only

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

kshepherd
authored and
milanmajchrak
committed
Move taskfile -T option to CLI script config only

kshepherd
authored and
milanmajchrak
committed
Fix broken tests due to random order execution. When CreateMissingIdentifiersIT is run before WorkflowCurationIT, it was causing the latter to fail.

tdonohue
authored and
milanmajchrak
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1331

PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1331
milanmajchrak wants to merge 18 commits into
customer/palo-dockerfrom
palo-docker-security-patches-7.6.7

Commits on Jun 11, 2026

ORE aggregated resource URI validation

Velocity and template safety for Email and LDN messages

Better null checking in allowed config props

Access configurationService at runtime, not rely on class setup

Remove strict mode Velocity engine configuration (allow nulls)

Filter requests for JSPs or traversal

Add additional logging to GlobalRequestSecurityFilter

Fix import order

Update sitemap traversal test expectations

Backport GlobalRequestSecurityFilter for javax

Add secure file access methods

Backport Curation I/O using secure file access

Curation config support for allowed base paths

Move curation -r reporter param to CLI only

Fix import order

Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

Move taskfile -T option to CLI script config only

Fix broken tests due to random order execution. When CreateMissingIdentifiersIT is run before WorkflowCurationIT, it was causing the latter to fail.