From 27ad4a3e633da85ef58bb91d96ebd1ce1d777534 Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Fri, 21 Aug 2026 15:08:51 -0400 Subject: [PATCH 1/3] correct instructions for blocking API endpoints #12232 --- doc/sphinx-guides/source/installation/config.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/sphinx-guides/source/installation/config.rst b/doc/sphinx-guides/source/installation/config.rst index 841f28391c2..3ac34266f92 100644 --- a/doc/sphinx-guides/source/installation/config.rst +++ b/doc/sphinx-guides/source/installation/config.rst @@ -3394,11 +3394,11 @@ dataverse.api.blocked.endpoints A comma-separated list of API endpoints that should be blocked. A minimal example that blocks endpoints for security reasons: -``./asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=api/admin,api/builtin-users'`` +``./asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=admin,builtin-users'`` Another example: -``./asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=api/admin,api/builtin-users,api/datasets/:persistentId/versions/:versionId/files,api/files/:id'`` +``./asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=admin,builtin-users,datasets/:persistentId/versions/:versionId/files,files/:id'`` Defaults to an empty string (no endpoints blocked), but, in almost all cases, should include at least ``admin, builtin-users`` as a security measure. From 70258b094652fca21b6744aee85935811abc5dd7 Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Fri, 21 Aug 2026 15:13:20 -0400 Subject: [PATCH 2/3] add release note snippet #12232 --- doc/release-notes/12232-block-api-endpoints.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 doc/release-notes/12232-block-api-endpoints.md diff --git a/doc/release-notes/12232-block-api-endpoints.md b/doc/release-notes/12232-block-api-endpoints.md new file mode 100644 index 00000000000..3e96c08bc61 --- /dev/null +++ b/doc/release-notes/12232-block-api-endpoints.md @@ -0,0 +1,17 @@ +## Upgrade Instructions + +1. Ensure API endpoints are blocked + +It is very important for the "admin" API endpoint to be blocked. Additionally, we recommend blocking the "builtin-users" endpoint. See [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) for details. + +In the command below, replace "demo.dataverse.org" with the name of your server. Do the check remotely, not from the server itself. + +`curl https://demo.dataverse.org/api/admin/settings` + +If you can see your settings, follow the instructions [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) to block API endpoints. + +Please note that as reported in #12232, versions of the guides from 6.7 through 6.11 incorrectly described how to configure the setting `dataverse.api.blocked.endpoints`. This was fixed in pull request #12636 for the 6.12 guides. The following is the correct command to use: + +`asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=admin,builtin-users'` + +That is, the comma-separated list should be "admin,builtin-users" and not "api/admin,api/builtin-users" as described in previous versions of the guides. \ No newline at end of file From 67b96ecfb37e20695a0288926d62c1ba7528181b Mon Sep 17 00:00:00 2001 From: Philip Durbin Date: Fri, 21 Aug 2026 15:19:25 -0400 Subject: [PATCH 3/3] typo --- doc/release-notes/12232-block-api-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/release-notes/12232-block-api-endpoints.md b/doc/release-notes/12232-block-api-endpoints.md index 3e96c08bc61..8937090737b 100644 --- a/doc/release-notes/12232-block-api-endpoints.md +++ b/doc/release-notes/12232-block-api-endpoints.md @@ -8,7 +8,7 @@ In the command below, replace "demo.dataverse.org" with the name of your server. `curl https://demo.dataverse.org/api/admin/settings` -If you can see your settings, follow the instructions [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) to block API endpoints. +If you can see your settings, follow the instructions in [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) to block API endpoints. Please note that as reported in #12232, versions of the guides from 6.7 through 6.11 incorrectly described how to configure the setting `dataverse.api.blocked.endpoints`. This was fixed in pull request #12636 for the 6.12 guides. The following is the correct command to use: