SOLR-13971: Revert changes to the default configset. * clarified these are Java system properties * trivial dead code change; Boolean.getBoolean returns a primitive

solr/CHANGES.txt

@@ -154,10 +154,9 @@ Jetty 9.4.19.v20190610
 Upgrade Notes
 ----------------------
 
-* Velocity response writer is no longer available to be used through the _default configset. In order
-  to use it, you would need to manually add it to your configset. Also, the initialization parameters 
+* Velocity: The initialization parameters
   "params.resource.loader.enabled" and "solr.resource.loader.enabled" have been removed and replaced by
-  startup parameters "velocity.resourceloader.params.enabled" and "velocity.resourceloader.solr.enabled"
+  Java system properties "velocity.resourceloader.params.enabled" and "velocity.resourceloader.solr.enabled"
   respectively (both turned off by default). Please see SOLR-13971 for more details.
 
 Bug Fixes
@@ -171,8 +170,8 @@ Bug Fixes
 
 * SOLR-13465: CoreContainer.auditloggerPlugin should be volatile (janhoy, hossman)
 
-* SOLR-13971: Velocity response writer's resource loading now possible only through startup parameters. Also, removed velocity 
-  response writer from _default configset. (Ishan Chattopadhyaya)
+* SOLR-13971: Velocity response writer's resource loading now possible only through startup parameters.
+  (Ishan Chattopadhyaya, David Smiley)
 
 ==================  8.3.0 ==================
 

solr/contrib/velocity/src/java/org/apache/solr/response/VelocityResponseWriter.java

@@ -108,12 +108,10 @@ public class VelocityResponseWriter implements QueryResponseWriter, SolrCoreAwar
     }
 
     // params resource loader: off by default
-    Boolean prle = Boolean.getBoolean(PARAMS_RESOURCE_LOADER_ENABLED);
-    paramsResourceLoaderEnabled = (null == prle ? false : prle);
+    paramsResourceLoaderEnabled = Boolean.getBoolean(PARAMS_RESOURCE_LOADER_ENABLED);
 
     // solr resource loader: off by default
-    Boolean srle = Boolean.getBoolean(SOLR_RESOURCE_LOADER_ENABLED);
-    solrResourceLoaderEnabled = (null == srle ? false : srle);
+    solrResourceLoaderEnabled = Boolean.getBoolean(SOLR_RESOURCE_LOADER_ENABLED);
 
     initPropertiesFileName = (String) args.get(PROPERTIES_FILE);
 

solr/core/src/test-files/solr/configsets/_default/conf/solrconfig.xml

@@ -81,6 +81,8 @@
   <lib dir="${solr.install.dir:../../../..}/contrib/langid/lib/" regex=".*\.jar" />
   <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-langid-\d.*\.jar" />
 
+  <lib dir="${solr.install.dir:../../../..}/contrib/velocity/lib" regex=".*\.jar" />
+  <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-velocity-\d.*\.jar" />
   <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-ltr-\d.*\.jar" />
 
   <!-- an exact 'path' can be used instead of a 'dir' to specify a
@@ -787,7 +789,7 @@
        (SearchHandler) can be registered multiple times with different
        names (and different init parameters)
     -->
-  <requestHandler name="/browse" class="solr.SearchHandler" useParams="query,facets,browse">
+  <requestHandler name="/browse" class="solr.SearchHandler" useParams="query,facets,velocity,browse">
     <lst name="defaults">
       <str name="echoParams">explicit</str>
     </lst>
@@ -1297,6 +1299,15 @@
     <str name="content-type">text/plain; charset=UTF-8</str>
   </queryResponseWriter>
 
+  <!--
+     Custom response writers can be declared as needed...
+    -->
+  <queryResponseWriter name="velocity" class="solr.VelocityResponseWriter" startup="lazy">
+    <str name="template.base.dir">${velocity.template.base.dir:}</str>
+    <str name="solr.resource.loader.enabled">${velocity.solr.resource.loader.enabled:true}</str>
+    <str name="params.resource.loader.enabled">${velocity.params.resource.loader.enabled:false}</str>
+  </queryResponseWriter>
+
   <!-- XSLT response writer transforms the XML output by any xslt file found
        in Solr's conf/xslt directory.  Changes to xslt files are checked for
        every xsltCacheLifetimeSeconds.

solr/server/solr/configsets/_default/conf/solrconfig.xml

@@ -81,6 +81,8 @@
   <lib dir="${solr.install.dir:../../../..}/contrib/langid/lib/" regex=".*\.jar" />
   <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-langid-\d.*\.jar" />
 
+  <lib dir="${solr.install.dir:../../../..}/contrib/velocity/lib" regex=".*\.jar" />
+  <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-velocity-\d.*\.jar" />
   <lib dir="${solr.install.dir:../../../..}/dist/" regex="solr-ltr-\d.*\.jar" />
 
   <!-- an exact 'path' can be used instead of a 'dir' to specify a
@@ -787,7 +789,7 @@
        (SearchHandler) can be registered multiple times with different
        names (and different init parameters)
     -->
-  <requestHandler name="/browse" class="solr.SearchHandler" useParams="query,facets,browse">
+  <requestHandler name="/browse" class="solr.SearchHandler" useParams="query,facets,velocity,browse">
     <lst name="defaults">
       <str name="echoParams">explicit</str>
     </lst>
@@ -1297,6 +1299,15 @@
     <str name="content-type">text/plain; charset=UTF-8</str>
   </queryResponseWriter>
 
+  <!--
+     Custom response writers can be declared as needed...
+    -->
+  <queryResponseWriter name="velocity" class="solr.VelocityResponseWriter" startup="lazy">
+    <str name="template.base.dir">${velocity.template.base.dir:}</str>
+    <str name="solr.resource.loader.enabled">${velocity.solr.resource.loader.enabled:true}</str>
+    <str name="params.resource.loader.enabled">${velocity.params.resource.loader.enabled:false}</str>
+  </queryResponseWriter>
+
   <!-- XSLT response writer transforms the XML output by any xslt file found
        in Solr's conf/xslt directory.  Changes to xslt files are checked for
        every xsltCacheLifetimeSeconds.

solr/solr-ref-guide/src/velocity-response-writer.adoc

@@ -40,6 +40,8 @@ The above example shows the optional initialization and custom tool parameters u
 
 === VelocityResponseWriter Startup Parameters
 
+These are Java system properties to mitigate security risks.
+
 `velocity.resourceloader.params.enabled`::
 The "params" resource loader allows templates to be specified in Solr request parameters. For example:
 +