From: Jonatan Kronqvist
- Vaadin @version@ is a maintenance release that includes a
- number of important bug fixes, as listed in the list of enhancements and change log below.
- For a list of enhancements in the last feature release, see
- Enhancements in Vaadin
- @version-minor@ and the Release
- Notes for Vaadin @version-minor@.0.
-
- Vaadin 7.1.11 fixes two security issues discovered during internal review.
- Escaping of OptionGroup item icon URLs
- The issue affects OptionGroup with item icons. Proper escaping of the
- src-attribute on the client side was not ensured when using icons for
- OptionGroup items. This could potentially, in certain situations, allow
- a malicious user to inject content, such as javascript, in order to
- perform a cross-site scripting (XSS) attack.
-
- In order for an application to be vulnerable, user provided input must
- be used to form a URL used to display an icon for an OptionGroup item,
- when showing that Option Group to other users. Escaping of URLs in Util.getAbsoluteUrl()
- The client side Util.getAbsoluteUrl() did not ensure proper escaping
- of the given URL. This could potentially, in certain situations, allow
- a malicious user to inject content, such as javascript, in order to
- perform a cross-site scripting (XSS) attack.
-
- The method is used internally by the framework in such a manner that it
- is unlikely this attack vector can be utilized in practice. However,
- third party components, or future use of the method, could make an
- attack viable. This release includes the following closed issues:
You can also view the list
- of the closed issues at the Vaadin developer's site. .
+ of the closed issues
Overview of Vaadin @version@ Release
Security fixes in Vaadin Framework 7.1.11
-
-
- The vulnerability has been classified as moderate, due to it's limited
- application.
-
- The vulnerability has been classified as moderate, due to it's limited
- application.
- Change log for Vaadin @version@
Tools have been updated for Vaadin @version-minor@ with - the following changes:
- -- Vaadin 7 requires that you use a compatible version of the - Vaadin Plugin for Eclipse. The stable version of the plugin - is available from the - http://vaadin.com/eclipse - update site. Please see the section - about updating the plugin in the Book of Vaadin and the - installation - instructions at the download site for more details. -
- -- You can also use the experimental Vaadin Plugin for - Eclipse. Its update site is - http://vaadin.com/eclipse/experimental - . -
- -When upgrading from an earlier Vaadin version, you must:
@@ -449,11 +349,8 @@ version. Binary compatibility is only guaranteed for maintenance releases of Vaadin. -Remember also to refresh the project in your IDE to @@ -492,12 +389,9 @@ the contents of the vaadin-client-compiled and vaadin-themes must be extracted to the ROOT/html/VAADIN directory in the Liferay installation. If your portal uses custom - widgets, install the latest version of Vaadin - Control Panel for Liferay for easy widget set - compilation - when it is available - the add-on is not - compatible with Vaadin @version@ at the time of this Vaadin - release. + widgets, you can use + Liferay Control Panel for Vaadin for easy widget set compilation.
- Vaadin supports the following desktop browsers: + Vaadin @version@ supports the following desktop browsers:
Vaadin SQL Container supports the following databases:
@@ -674,9 +569,10 @@