Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

authorization for api call to system/info is not checked

#528
  • Issue Type: Bug
  • Rundeck version: 1.4.2

Issue:

Making the api request for system info at /api/1/system/info does not properly check the authorization required. The authorization should require this aclpolicy declaration in the application context:

 resource:
    - equals:
        kind: system
      allow: [read] # allow read of system info

Reproduce:

Remove the authorization listed above for a user or api_token_group.

Request the /api/1/system/info endpoint.

The result is the system info data, which should not be allowed.

Reported by Greg Schueler · February 23rd, 2012 @ 06:36 PM

State: resolved
Milestone: Rundeck 1.4.3
Assigned to: Greg Schueler Greg Schueler

Activity

  1. Greg Schueler
    Greg Schueler
    • State changed from new to needs_verification
    • Milestone order changed from 8 to 0

    April 30th, 2012 @ 06:34 PM

  2. Greg Schueler
    Greg Schueler
    • State changed from needs_verification to resolved

    May 17th, 2012 @ 11:22 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.