May I know if backdrop vulnerable to the Log4shell/Log4j (CVE-2021-44228) in any stage or version or third party plugin found vulnerable to this ? Is there any official statement from backdrop on this ? I need a firm answer on this. Thanks.
Backdrop is definitely not vulnerable because of Log4j. Log4j is a Java component; Backdrop doesn't directly use Java, it's written in PHP, HTML, and JavaScript, with a smattering of scripting languages and configurations.
Note: I don't speak officially for Backdrop, but I'm pretty confident about this.
This is a security precaution. It's not recommended and it's not documented in the settings.php file, but you can set allow_insecure_uploads to be TRUE if you wish to allow uploading files like...
You can create a small custom module using this hook:
https://github.com/backdrop-contrib/webform/blob/136c20cb1c51cea203f3f0bc5355237c1d4dbf84/webform.api.php#L652-L678
/**
* Determine...
Posted2 days 17 hours ago by Martin Price (yorkshirepudding) on:
Comments
Backdrop is definitely not vulnerable because of Log4j. Log4j is a Java component; Backdrop doesn't directly use Java, it's written in PHP, HTML, and JavaScript, with a smattering of scripting languages and configurations.
Note: I don't speak officially for Backdrop, but I'm pretty confident about this.
I'm glad to hear this. Thanks for your affirmation.