Skip to content

Commit 4d2f05f

Browse files
reekitconceptreekitconcept
committed
Upgrade to Solr 9.10 with external Tika server (CVE-2025-66516 fix)
- Upgrade Solr from 8 to 9.10 - Add external Tika server (3.2.3) to mitigate CVE-2025-66516 - Update solrconfig.xml for Solr 9 compatibility (luceneMatchVersion 9.12) - Configure extraction handler to use external Tika server - Remove deprecated local Tika library loading - Add Makefile targets for solr-activate-and-reindex
1 parent 28eddca commit 4d2f05f

File tree

12 files changed

+112
-33
lines changed

12 files changed

+112
-33
lines changed

‎Makefile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,50 @@ stack-rm: ## Local Stack: Remove Services and Volumes
182182
@echo "Remove local volume data"
183183
@docker volume rm $(PROJECT_NAME)_vol-site-data
184184

185+
186+
###########################################
187+
# SOLR
188+
###########################################
189+
190+
BACKEND_FOLDER=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
191+
192+
SOLR_DATA_FOLDER?=${BACKEND_FOLDER}/data
193+
SOLR_ONLY_COMPOSE?=${BACKEND_FOLDER}/docker-compose.yml
194+
195+
## Solr docker utils
196+
test-stack-name:
197+
# The STACK_NAME env variable must exist and discriminate between your projects,
198+
# and the purpose of the container (_DEV, _STACK, _TEST)
199+
test -n "$(STACK_NAME)"
200+
201+
.PHONY: solr-start
202+
solr-start: test-stack-name ## Start solr
203+
@echo "Start solr"
204+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} up -d solr tika
205+
206+
.PHONY: solr-start-fg
207+
solr-start-fg: test-stack-name ## Start solr in foreground
208+
@echo "Start solr in foreground"
209+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} up solr tika
210+
211+
.PHONY: solr-stop
212+
solr-stop: test-stack-name ## Stop solr
213+
@echo "Stop solr"
214+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} down solr tika
215+
216+
.PHONY: solr-logs
217+
solr-logs: test-stack-name ## Show solr logs
218+
@echo "Show solr logs"
219+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} logs -f solr
220+
221+
.PHONY: solr-activate-and-reindex
222+
solr-activate-and-reindex: ## Activate solr and reindex content
223+
$(MAKE) -C "./backend/" solr-activate-and-reindex
224+
225+
.PHONY: solr-activate-and-reindex-clear
226+
solr-activate-and-reindex-clear: ## Activate solr and reindex content with clear
227+
$(MAKE) -C "./backend/" solr-activate-and-reindex-clear
228+
185229
###########################################
186230
# Acceptance
187231
###########################################

‎backend/Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,14 @@ console: $(VENV_FOLDER) instance/etc/zope.ini ## Start a console into a Plone in
9494
create-site: $(VENV_FOLDER) instance/etc/zope.ini ## Create a new site from scratch
9595
@$(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/create_site.py
9696

97+
.PHONY: solr-activate-and-reindex
98+
solr-activate-and-reindex: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content
99+
@PYTHONWARNINGS=ignore $(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py
100+
101+
.PHONY: solr-activate-and-reindex-clear
102+
solr-activate-and-reindex-clear: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content with clear
103+
@PYTHONWARNINGS=ignore $(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py --clear
104+
97105
# Example Content
98106
.PHONY: update-example-content
99107
update-example-content: $(VENV_FOLDER) ## Export example content inside package

‎backend/news/+fix-tikka-sec-vulnerability.bugfix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Upgrade to Solr 9.10 with external Tika server 3.2.3 to fix CVE-2025-66516. @reebalazs

‎backend/src/kitconcept/solr/profiles/default/metadata.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<metadata>
3-
<version>1000</version>
3+
<version>1001</version>
44
<dependencies>
55
<dependency>profile-collective.solr:default</dependency>
66
</dependencies>

‎backend/src/kitconcept/solr/profiles/default/registry/collective.solr.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<registry>
3+
4+
<record name="collective.solr.use_tika">
5+
<value>True</value>
6+
</record>
7+
8+
</registry>

‎backend/src/kitconcept/solr/upgrades/configure.zcml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,15 @@
44
i18n_domain="kitconcept.solr"
55
>
66

7+
<genericsetup:upgradeSteps
8+
profile="kitconcept.solr:default"
9+
source="1000"
10+
destination="1001"
11+
>
12+
<genericsetup:upgradeDepends
13+
title="Enable use_tika in collective.solr for external Tika server"
14+
import_steps="plone.app.registry"
15+
/>
16+
</genericsetup:upgradeSteps>
17+
718
</configure>

‎docker-compose-ci.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,27 @@ name: kitconcept-solr-ci
77

88
services:
99

10+
tika-acceptance:
11+
image: apache/tika:3.2.3.0-full
12+
profiles: ["ci"]
13+
ports:
14+
- 9998:9998
15+
1016
solr-acceptance:
1117
build:
1218
context: ./solr
1319
profiles: ["ci"]
20+
depends_on:
21+
- tika-acceptance
1422
ports:
1523
- 8983:8983
1624
command:
1725
- solr-precreate
1826
- plone
1927
- /plone-config
28+
environment:
29+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998 -Dsolr.config.lib.enabled=true"
30+
2031
frontend-acceptance:
2132
image: ghcr.io/kitconcept/kitconcept-solr-frontend:${BASE_TAG}
2233
pull_policy: always

‎docker-compose-dev.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,27 @@ name: kitconcept-solr-acceptance
33

44
services:
55

6+
tika-acceptance:
7+
image: apache/tika:3.2.3.0-full
8+
profiles: ["acceptance", "dev", "solr"]
9+
ports:
10+
- 9998:9998
11+
612
solr-acceptance:
713
build:
814
context: ./solr
915
pull_policy: build
1016
profiles: ["acceptance", "dev", "solr"]
17+
depends_on:
18+
- tika-acceptance
1119
ports:
1220
- 8983:8983
1321
command:
1422
- solr-precreate
1523
- plone
1624
- /plone-config
25+
environment:
26+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998 -Dsolr.config.lib.enabled=true"
1727

1828
frontend: &frontend
1929
build:

‎docker-compose.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,24 @@ services:
9898
- traefik.http.routers.rt-backend-classic.service=svc-backend
9999
- traefik.http.routers.rt-backend-classic.middlewares=gzip,mw-backend-auth,mw-backend-vhm-classic
100100

101+
tika:
102+
image: apache/tika:3.2.3.0-full
103+
ports:
104+
- 9998:9998
105+
101106
solr:
102107
build:
103108
context: solr/
104109
ports:
105110
- 8983:8983
111+
depends_on:
112+
- tika
106113
command:
107114
- solr-precreate
108115
- plone
109116
- /plone-config
110-
117+
environment:
118+
SOLR_OPTS: "-Dsolr.tika.url=http://tika:9998 -Dsolr.config.lib.enabled=true"
111119

112120
volumes:
113121
vol-site-data: {}

‎news/+fix-tikka-sec-vulnerability.bugfix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Upgrade to Solr 9.10 with external Tika server 3.2.3 to fix CVE-2025-66516. @reebalazs

0 commit comments

Comments
 (0)