Page History

...

Classes DirectoryConfigProvider and FileConfigProvider that implements the ConfigProvider interface will be updated. In the configure() method of the classes, the newly added configuration will be retrieved. Their get() method will then verify whether the file it is attempting to access resides within the designated paths and recursive access to directories will be allowed. If the file is not within any of the designated paths, an empty string will be returned for the value. This behaviour is consistent with how EnvVarConfigProvider handles when user attempts to access environment variables that are not allowed. When using FileConfigProvider, users can also specify files in the allowed.paths to limit access to specific files so that other files in the same directory are not accessible.

...