Summary
-------
A security issue affects the JasperReports Menu userview plugin. A specially crafted
report definition (JRXML) could be used to run commands on the server. This hotfix
closes that risk without requiring a full product upgrade.

What the hotfix contains
------------------------
The package contains three files that work together:

  1. jasperreports.properties
     Turns on JasperReports' built-in protection that stops report expressions from
     using dangerous Java classes.

  2. groovy-sandbox-1.26-jaspersoft-2.jar
     A supporting library required for reports written in the "Groovy" language to
     keep working once the protection above is enabled.

  3. jasperreports-groovy-method-guard-aspect-1.0.0.jar
     An additional safeguard that blocks a further way commands could be run from a
     Groovy report, which the built-in protection alone does not cover.

All three are needed. Please install them together.

How to install
--------------
  1. Stop your Joget (Tomcat) instance.

  2. Copy the files from this package into your Joget web application folder
     (the folder that contains "WEB-INF"; typically <tomcat>/webapps/jw/), keeping
     the same folder layout:

         WEB-INF/classes/jasperreports.properties
         WEB-INF/lib/groovy-sandbox-1.26-jaspersoft-2.jar
         WEB-INF/lib/jasperreports-groovy-method-guard-aspect-1.0.0.jar

     If a WEB-INF/classes/jasperreports.properties file already exists, do NOT
     overwrite it. Instead, open it and add this single line:

         net.sf.jasperreports.report.class.filter.enabled=true

  3. Start your Joget instance.

No database changes and no rebuild are required.
