From cc9df5af05f08396d6708c5d0644db342ff18c6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20H=C3=B8ydahl?= <janhoy@users.noreply.github.com>
Date: Thu, 2 Jul 2020 15:37:53 +0200
Subject: [PATCH] SOLR-14561: Adding upgrade notes for allowPaths (#1641)

---
 solr/solr-ref-guide/src/solr-upgrade-notes.adoc | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/solr/solr-ref-guide/src/solr-upgrade-notes.adoc b/solr/solr-ref-guide/src/solr-upgrade-notes.adoc
index 7fd79f57487..1b2f71ac4de 100644
--- a/solr/solr-ref-guide/src/solr-upgrade-notes.adoc
+++ b/solr/solr-ref-guide/src/solr-upgrade-notes.adoc
@@ -85,10 +85,17 @@ For more information about how to use this, see the section <<exporting-result-s
 
 * The `stats`, `facet`, and `timeseries` expressions now support percentiles and standard deviation aggregations.
 
-*Deprecations* 
+*Restricting file paths*
+
+Several Solr APIs allow specifying a file system location. This includes core creation, backup, restore and others. Prior to Solr 8.6 these parameters were not validated, and Solr would allow any absolute or relative path. From 8.6 we by default allow only paths that are relative to `SOLR_HOME`, `SOLR_DATA_HOME` and `coreRootDir`. If you need to create a core or store a backup outside these pre-allowed paths, you now need to tell Solr about what paths to allow.
+
+Solr can be configured with a comma separated list of paths to allow in `solr.xml` using the new `allowPaths` element, see <<format-of-solr-xml.html#the-solr-element,Solr.xml Parameters>>. When using the `solr.xml` file shipping with 8.6, you can configure the list of paths to allow through the system property `solr.allowPaths`. Please see `bin/solr.in.sh` or `bin\solr.in.cmd` for example usage. Using the value `*` will allow any path as in erlier versions.
+
+Windows SMB shares on the UNC format, such as `\\myhost\myshare\mypath` are now always disallowed. Please use drive letter mounts instead, i.e. `S:\mypath`.
+
+*Deprecations*
 
 * Cross Data Center Replication (CDCR), in its current form, is deprecated and is scheduled to be removed in 9.0. Please refer to SOLR-14022.
-*Deprecations*
 
 * Data Import Handler is deprecated and is scheduled to be removed in 9.0. A community supported version of this may be available as an external package to be used with the package management system. For more details, please refer to SOLR-14066.