Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check for user permission before delete input resource #4858

Closed
1Jesper1 opened this issue Jun 22, 2018 · 0 comments · Fixed by #4867
Closed

Check for user permission before delete input resource #4858

1Jesper1 opened this issue Jun 22, 2018 · 0 comments · Fixed by #4867
Assignees
@dennisoelkers
Labels
blocker If not finished by release date, the release will be postponed. bug security triaged
Milestone
2.4.6

Comments

@1Jesper1
Copy link

graylog2-server/graylog2-server/src/main/java/org/graylog2/rest/resources/system/inputs/InputsResource.java

Line 161 in 365d26f

inputService.destroy(input);

@dennisoelkers dennisoelkers added bug security blocker If not finished by release date, the release will be postponed. triaged labels Jun 25, 2018
@dennisoelkers dennisoelkers modified the milestones: 3.0.0, 2.4.6 Jun 25, 2018
@dennisoelkers dennisoelkers self-assigned this Jun 25, 2018
dennisoelkers added a commit that referenced this issue Jun 26, 2018
@dennisoelkers
Check for permission before terminating input.
e703dae 
Before this change it was possible to terminate any input for every
authenticated user. This change introduces a check for the
`inputs:terminate:<input id>` permission before terminating an input.

Fixes #4858.
@dennisoelkers dennisoelkers mentioned this issue Jun 26, 2018
Merged
9 tasks
bernd pushed a commit that referenced this issue Jun 28, 2018
@dennisoelkers @bernd
Check for permission before terminating input. (#4867)
0582e31 
Before this change it was possible to terminate any input for every
authenticated user. This change introduces a check for the
`inputs:terminate:<input id>` permission before terminating an input.

Fixes #4858.
bernd pushed a commit that referenced this issue Jun 28, 2018
@dennisoelkers @bernd
Check for permission before terminating input. (#4867)
76ec688 
Before this change it was possible to terminate any input for every
authenticated user. This change introduces a check for the
`inputs:terminate:<input id>` permission before terminating an input.

Fixes #4858.

(cherry picked from commit 0582e31)
@bernd bernd mentioned this issue Jun 28, 2018
Merged
dennisoelkers pushed a commit that referenced this issue Jun 28, 2018
@bernd @dennisoelkers
Check for permission before terminating input. (#4867) (#4874)
9618d75 
Before this change it was possible to terminate any input for every
authenticated user. This change introduces a check for the
`inputs:terminate:<input id>` permission before terminating an input.

Fixes #4858.

(cherry picked from commit 0582e31)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dennisoelkers dennisoelkers

Labels
blocker If not finished by release date, the release will be postponed. bug security triaged
Projects
None yet
Milestone
2.4.6
Development

Successfully merging a pull request may close this issue.

Check for permission before terminating input. Graylog2/graylog2-server
2 participants
@dennisoelkers @1Jesper1