[VELTOOLS-150] VelocityLayoutServlet allows clients to specify "layout" without performing any security checks.

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.4, 2.0
• Fix Version/s: 3.0
• Component/s: VelocityView
• Labels: security
• Environment: Velocity 1.7, Velocity Tools 2.0.; Confirmed also affects Velocity 1.4, Velocity Tools 1.4.
• Assignee: Claude Brisson
• Reporter: Christopher Schultz
• Created: 05/Jan/12 22:31
• Updated: 29/Sep/18 22:06
• Resolved: 25/Jun/18 22:48

Description

For reference:
http://markmail.org/thread/43cz2dymzmxjjrq5