Aller au contenu principal
Jahia Store
FR

Request Safety Patch

supported
Télécharger 1.14.1

Informations

Identifiant du module
request-safety-patch
Identifiant de groupe
org.jahia.modules
Statut
supported
Catégorie
Security
Auteur
JSG
Site web du développeur
http://www.jahia.com
Nécessite Jahia
8.0.0.0
Mis à jour
2026-08-05
Source
scm:git:git@github.com:Jahia/request-safety-patch.git
Étiquettes
  • security

This module protects against two security vulnerabilities discovered in Jahia and documented on the Academy: https://academy.jahia.com/customer-center/security/security-advisories/security-patch-june-2026-jahia

Versions

  • Disable double slash rejection by default, this corrects compatibility issues noticed with some other Jahia modules
Nécessite Jahia 8.0.0.0Mis à jour 2026-08-05
  • Fixed the WebFlow expression-injection guard blanking unrelated pages: it now inspects only WebFlow fragments, so a request parameter name containing a parenthesis (as produced by routine vulnerability scanners) no longer renders an empty page nor stores that empty page in the HTML cache for subsequent visitors. Protection against the injection itself is unchanged.
  • Enlarge the scope of the detection for malformed URL. 
Nécessite Jahia 8.0.0.0Mis à jour 2026-07-30

Bug fixes

  • Ensured we blanked only nt_base/html/link.jsp views 
Nécessite Jahia 8.0.0.0Mis à jour 2026-07-28

Improvements

  • Ensured the built-in link component always renders through this patch's safe view: any other source of that view is now blocked, so request parameters can no longer be reflected unescaped through it.
  • Blocked double-encoded URLs before security filters to prevent unauthenticated access to admin tools.
Nécessite Jahia 8.0.0.0Mis à jour 2026-07-24

Improvements

Hardened the /atmosphere X-Atmosphere-Post-Body block to scan the raw query string

Nécessite Jahia 8.0.0.0Mis à jour 2026-07-15

Improvements

Closed an additional /atmosphere bypass using a GET request

Nécessite Jahia 8.0.0.0Mis à jour 2026-07-14

Improvements

Escapes nt:base link view params and pause HTML externalization filter

Nécessite Jahia 8.0.0.0Mis à jour 2026-07-14

Improvements

  • Closed /atmosphere/rpc filter bypass
Nécessite Jahia 8.0.0.0Mis à jour 2026-06-26

Initial version of the module

Nécessite Jahia 8.0.0.0Mis à jour 2026-06-01