Comments (2)
mszu
commented on May 25, 2024
The reason behind Adobe's recommendation for blocking those paths (and the reason that they're "dangerous") is that they allow low level access to/control over the instance. Via the groovy console, it's possible to do pretty much anything you can do via the UIs exposed by the blocked URLs (e.g. starting or stopping bundles, installing or uninstalling packages, getting an admin session and changing properties, etc).
If you're blocking those paths, you should probably also block access to the groovy console.
That said, I guess it wouldn't hurt anything to make the change you're suggesting, so if you want to open a PR I would not personally have a problem with merging it (as long as the other maintainers are happy with it).
from aem-groovy-console.
markdaugherty
commented on May 25, 2024
Fixed in develop.
from aem-groovy-console.
Related Issues (20)
- Groovy console does not execute scripts with admin user HOT 3
- Groovy console 14.0 exception in AEM 6.5.3
- Please update jQuery and Moment frontend dependencies HOT 7
- Version 15.1.0 does not run on AEM 6.4.5 HOT 2
- Released artifacts not available 16.0.0 HOT 2
- ClassNotFound: ScriptContext
- 14.0.0 : 'Save' and 'Open' buttons are missing on Publish Instance HOT 2
- Not working with Java 11 HOT 1
- aem-groovy-console bundle status is in installed state rather than active, HOT 1
- Make compatible with AEMaaCS HOT 1
- Improvements for long-running scripts HOT 1
- No buttons appear on Console
- How to install? Where do you put the downloaded zip? HOT 1
- groovyConsole: email option not working on cloud
- Table rendering breaks on subsequent runs
- Update readme to point to new maintained AEM groovy console
- NoClassDef Found Error when running a script with recurse
- Request agnostic groovy console service script execution HOT 2
- Subpackage / OakPAL validation error
- After #90, always allow admin change is broken HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aem-groovy-console.