By using the upload document function, an attacker could potentially upload an HTML
page to CollabNet
TeamForge that contains active code, such
as JavaScript. This active code would then be executed by clients' browsers when they view
the page.
To prevent an attack of this sort, you can specify whether or not HTML code is
displayed in CollabNet
TeamForge. This flag applies to all
documents, tracker, task, and forum attachments, and files in the file release system.
-
Set
the SAFE_DOWNLOAD_MODE token. For more information, see
SAFE_DOWNLOAD_MODE.
-
Create
the runtime environment.
- /opt/collabnet/teamforge/installer/install.sh