youngkermit8-coder opened a new pull request, #1687: URL: https://github.com/apache/rocketmq-dashboard/pull/1687
## Summary - require administrator permission for the NameServer connection-test endpoint; - prevent read-only users from making the dashboard server probe arbitrary hosts and ports; - preserve the connection setup workflow for administrators; - cover both reader rejection and administrator access with authorization regression tests. ## Root cause `/api/clusters/test-connection` was included in `AuthInterceptor.READER_POST_PATHS` even though it accepts an arbitrary `namesrvAddr` and opens a real RocketMQ admin connection from the server. That made a server-side network action available to non-admin readers, unlike the existing admin-only data-source connection test. ## Impact Authenticated readers now receive HTTP 403 before a NameServer probe can start. Administrators can continue testing candidate NameServer endpoints before registering an instance. ## Validation - `mvn -Dtest=AuthInterceptorTest,AuthServiceTest,AuthControllerTest test` — 41 tests passed; - Checkstyle reported 0 violations; - `mvn -DskipTests package` succeeded. Closes #1684 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
