Skip to content

Commit b8b0ba2

Browse files
reekitconceptreekitconcept
committed
Upgrade to Solr 9.10 with external Tika server (CVE-2025-66516 fix)
- Upgrade Solr from 8 to 9.10 - Add external Tika server (3.2.3) to mitigate CVE-2025-66516 - Update solrconfig.xml for Solr 9 compatibility (luceneMatchVersion 9.12) - Configure extraction handler to use external Tika server - Remove deprecated local Tika library loading - Add Makefile targets for solr-activate-and-reindex
1 parent 28eddca commit b8b0ba2

File tree

15 files changed

+179
-37
lines changed

15 files changed

+179
-37
lines changed

‎Makefile‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,55 @@ stack-rm: ## Local Stack: Remove Services and Volumes
182182
@echo "Remove local volume data"
183183
@docker volume rm $(PROJECT_NAME)_vol-site-data
184184

185+
186+
###########################################
187+
# SOLR
188+
###########################################
189+
190+
BACKEND_FOLDER=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
191+
192+
SOLR_DATA_FOLDER?=${BACKEND_FOLDER}/data
193+
SOLR_ONLY_COMPOSE?=${BACKEND_FOLDER}/docker-compose.yml
194+
195+
## Solr docker utils
196+
test-stack-name:
197+
# The STACK_NAME env variable must exist and discriminate between your projects,
198+
# and the purpose of the container (_DEV, _STACK, _TEST)
199+
test -n "$(STACK_NAME)"
200+
201+
.PHONY: solr-start
202+
solr-start: test-stack-name ## Start solr
203+
@echo "Start solr"
204+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} up -d solr tika
205+
206+
.PHONY: solr-start-and-rebuild
207+
solr-start-and-rebuild: test-stack-name ## Start solr and rebuild containers, erases content
208+
@echo "Start solr and rebuild"
209+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} up -d --build solr tika
210+
211+
.PHONY: solr-start-fg
212+
solr-start-fg: test-stack-name ## Start solr in foreground
213+
@echo "Start solr in foreground"
214+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} up solr tika
215+
216+
.PHONY: solr-stop
217+
solr-stop: test-stack-name ## Stop solr
218+
@echo "Stop solr"
219+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} down solr tika
220+
221+
.PHONY: solr-logs
222+
solr-logs: test-stack-name ## Show solr logs
223+
@echo "Show solr logs"
224+
@COMPOSE_PROJECT_NAME=${STACK_NAME} docker compose -f ${STACK_FILE} logs -f solr
225+
226+
.PHONY: solr-activate-and-reindex
227+
solr-activate-and-reindex: ## Activate solr and reindex content
228+
$(MAKE) -C "./backend/" solr-activate-and-reindex
229+
230+
.PHONY: solr-activate-and-reindex-clear
231+
solr-activate-and-reindex-clear: ## Activate solr and reindex content with clear
232+
$(MAKE) -C "./backend/" solr-activate-and-reindex-clear
233+
185234
###########################################
186235
# Acceptance
187236
###########################################

‎backend/Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,14 @@ console: $(VENV_FOLDER) instance/etc/zope.ini ## Start a console into a Plone in
9494
create-site: $(VENV_FOLDER) instance/etc/zope.ini ## Create a new site from scratch
9595
@$(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/create_site.py
9696

97+
.PHONY: solr-activate-and-reindex
98+
solr-activate-and-reindex: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content
99+
@PYTHONWARNINGS=ignore $(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py
100+
101+
.PHONY: solr-activate-and-reindex-clear
102+
solr-activate-and-reindex-clear: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content with clear
103+
@PYTHONWARNINGS=ignore $(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py --clear
104+
97105
# Example Content
98106
.PHONY: update-example-content
99107
update-example-content: $(VENV_FOLDER) ## Export example content inside package

‎backend/news/+fix-tikka-sec-vulnerability.breaking‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Upgrade to Solr 9.10 with external Tika server 3.2.3 to fix CVE-2025-66516. @reebalazs

‎backend/src/kitconcept/solr/profiles/default/metadata.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<metadata>
3-
<version>1000</version>
3+
<version>1001</version>
44
<dependencies>
55
<dependency>profile-collective.solr:default</dependency>
66
</dependencies>

‎backend/src/kitconcept/solr/profiles/default/registry/collective.solr.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<registry>
3+
4+
<record name="collective.solr.use_tika">
5+
<value>True</value>
6+
</record>
7+
8+
</registry>

‎backend/src/kitconcept/solr/upgrades/configure.zcml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,15 @@
44
i18n_domain="kitconcept.solr"
55
>
66

7+
<genericsetup:upgradeSteps
8+
profile="kitconcept.solr:default"
9+
source="1000"
10+
destination="1001"
11+
>
12+
<genericsetup:upgradeDepends
13+
title="Enable use_tika in collective.solr for external Tika server"
14+
import_steps="plone.app.registry"
15+
/>
16+
</genericsetup:upgradeSteps>
17+
718
</configure>

‎backend/tests/setup/test_setup_install.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,6 @@ class TestSetupInstall:
88
def test_addon_installed(self, installer):
99
assert installer.is_product_installed(PACKAGE_NAME) is True
1010

11-
def test_latest_version(self, profile_last_version):
12-
"""Test latest version of default profile."""
13-
assert profile_last_version(f"{PACKAGE_NAME}:default") == "1000"
14-
1511
def test_browserlayer(self, browser_layers):
1612
"""Test that IKitconceptSolrLayer is registered."""
1713
from kitconcept.solr.interfaces import IKitconceptSolrLayer

‎docker-compose-ci.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,28 @@ name: kitconcept-solr-ci
77

88
services:
99

10+
tika-acceptance:
11+
image: apache/tika:3.2.3.0-full
12+
profiles: ["ci"]
13+
ports:
14+
- 9998:9998
15+
1016
solr-acceptance:
1117
build:
1218
context: ./solr
1319
profiles: ["ci"]
20+
depends_on:
21+
- tika-acceptance
1422
ports:
1523
- 8983:8983
1624
command:
1725
- solr-precreate
1826
- plone
1927
- /plone-config
28+
environment:
29+
SOLR_MODULES: extraction
30+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998"
31+
2032
frontend-acceptance:
2133
image: ghcr.io/kitconcept/kitconcept-solr-frontend:${BASE_TAG}
2234
pull_policy: always

‎docker-compose-dev.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,28 @@ name: kitconcept-solr-acceptance
33

44
services:
55

6+
tika-acceptance:
7+
image: apache/tika:3.2.3.0-full
8+
profiles: ["acceptance", "dev", "solr"]
9+
ports:
10+
- 9998:9998
11+
612
solr-acceptance:
713
build:
814
context: ./solr
915
pull_policy: build
1016
profiles: ["acceptance", "dev", "solr"]
17+
depends_on:
18+
- tika-acceptance
1119
ports:
1220
- 8983:8983
1321
command:
1422
- solr-precreate
1523
- plone
1624
- /plone-config
25+
environment:
26+
SOLR_MODULES: extraction
27+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998"
1728

1829
frontend: &frontend
1930
build:

‎docker-compose.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,25 @@ services:
9898
- traefik.http.routers.rt-backend-classic.service=svc-backend
9999
- traefik.http.routers.rt-backend-classic.middlewares=gzip,mw-backend-auth,mw-backend-vhm-classic
100100

101+
tika:
102+
image: apache/tika:3.2.3.0-full
103+
ports:
104+
- 9998:9998
105+
101106
solr:
102107
build:
103108
context: solr/
104109
ports:
105110
- 8983:8983
111+
depends_on:
112+
- tika
106113
command:
107114
- solr-precreate
108115
- plone
109116
- /plone-config
110-
117+
environment:
118+
SOLR_MODULES: extraction
119+
SOLR_OPTS: "-Dsolr.tika.url=http://tika:9998"
111120

112121
volumes:
113122
vol-site-data: {}

0 commit comments

Comments
 (0)