Severity: High

Description: SAS Information Delivery Portal might allow unauthorized access to the server file system via the URL display portlet.

Potential Impact: A user can gain unauthorized access to the server file system.

Solution: After you apply the hot fix, take the following steps:

1. Create a new property, URLDisplayPortlet.UrlRestrictions, under the Advanced application properties for "SAS Information Delivery Portal 4.4," available through the Configuration Manager plug-in in SAS^® Management Console.
    
2. You can populate the Property Value field with a comma-delimited list of protocols and URL prefixes that are allowed to be displayed within the URL display portlet. Here are some examples of values:
    

   Description	Property Value field
   Allow only https and http traffic	http,https
   Disallow file:// protocol	!file
   Allow only URLs with a certain prefix	https://mysite.com/

   
    
3. Restart the web application server instance SASServer1_1 in order for these changes to take effect.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS Portal and Portlets 4.4_M7 is available at: