Articles dans cette section

Afficher plus

Enabling scripts in Portfolio 4.0.1 and later [FR]

Avatar
Don J.
  • Mise à jour

Cet article n’est disponible ni en français. En consultant cet article, vous contribuez à notre réflexion sur sa traduction future.

Si vous avez besoin de plus d’aide ou si vous avez des questions relatives à l’assistance, veuillez contacter notre équipe dédiée d’assistance en français à l’aide de ce formulaire : https://help.extensis.com/hc/fr/requests/new

Portfolio 3.6.3 and 4.0 were found to have a java reflection security issue that affected our Web Client scripting engine: CVE-2022-24252.

We resolved the issue in Portfolio 4.0.1 by disallowing the scripting engine from having read, write, and class loading access to specific locations and libraries.

This has the undesirable side effect of causing some Web Client scripts to fail when they are run.

If you find you have vital scripts that don’t run because of this update, you can enable scripting access to the restricted locations.

Important: Enabling scripting access in this way will effectively disable the security update for CVE-2022-24252.

While cumbersome, it is possible to disable the security update, run the required scripts, then re-enable the update.

Enable scripting access on Windows Server

  1. Open a Command Prompt or PowerShell window with Admin privileges.

  2. In the Command Prompt window, type

    notepad "%ProgramData%\Extensis\Portfolio Server\.preferences"

    In the PowerShell window, type

    notepad "$Env:ProgramData\Extensis\Portfolio Server\.preferences"

    This will open the .preferences file in Notepad.

  3. Scroll to the end of the file and on a new line, type

    server.scripting.allow.java.reflection=true

    then press Enter.

  4. Press Ctrl-S to save the file, then exit Notepad.

  5. Close the Command Prompt or PowerShell window.

  6. Restart Portfolio for the change to take effect.

Note: If you ever want to re-enable the security solution for CVE-2022-24252 then re-edit the file, find the line with server.scripting.allow.java.reflection=true, change true to false, save your changes, and restart Portfolio.

Enable scripting access on Macintosh

  1. Open Terminal and type pico /Library/Application\ Support/Extensis/Portfolio\ Server/.preferences then press Return.

    This opens the .preferences file in the pico editor.

  2. Press Ctrl-V until the block cursor is on a new line at the end of the file (press Return if necessary to get an empty line).

  3. Type server.scripting.allow.java.reflection=true and press Return.

  4. Press Ctrl-O then press Return to save the file.

  5. Once the file is saved, press Ctrl-X to exit the pico editor.

  6. Quit Terminal, then restart Portfolio for the change to take effect.

Note: If you ever want to re-enable the security solution for CVE-2022-24252 then re-edit the file, find the line with server.scripting.allow.java.reflection=true, change true to false, save your changes, and restart Portfolio.

Articles associés