[
https://issues.apache.org/jira/browse/AMQ-8522?focusedWorklogId=737210&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-737210
]
ASF GitHub Bot logged work on AMQ-8522:
---------------------------------------
Author: ASF GitHub Bot
Created on: 06/Mar/22 06:45
Start Date: 06/Mar/22 06:45
Worklog Time Spent: 10m
Work Description: jbonofre merged pull request #790:
URL: https://github.com/apache/activemq/pull/790
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscr...@activemq.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 737210)
Time Spent: 40m (was: 0.5h)
> Everybody granted full privileges on /api/* in jetty.xml
> --------------------------------------------------------
>
> Key: AMQ-8522
> URL: https://issues.apache.org/jira/browse/AMQ-8522
> Project: ActiveMQ
> Issue Type: Bug
> Components: Web Console
> Affects Versions: 5.16.4
> Reporter: Carsten Langer
> Assignee: Jean-Baptiste Onofré
> Priority: Major
> Fix For: 5.17.0, 5.16.5
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Everybody granted full privileges on {{/api/*}} in jetty.xml
> Before fixing AMQ-5388, the ContstraintMapping for the "user" role contained
> the path part {{{}"/api/*"{}}}, thus binding any API call to the "user" role.
> With the fix for AMQ-5388 the path part {{"/api/*"}} was removed. This has
> the effect that a request to {{"/api/message/..."}} or {{"/api/jolokia/..."}}
> is allowed to everybody.
> IMHO the path part {{"/api/*"}} should be added back to the
> ContstraintMapping mapping.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
