Skip to content

/ graylog2-server

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check for RestPermissions.LOOKUP_TABLES_READ #4861

Closed
1Jesper1 opened this issue Jun 23, 2018 · 3 comments
Closed

Check for RestPermissions.LOOKUP_TABLES_READ #4861

1Jesper1 opened this issue Jun 23, 2018 · 3 comments
Assignees
@bernd
Labels
bug security
Milestone
3.0.0

Comments

@1Jesper1
Copy link

@1Jesper1 1Jesper1 commented Jun 23, 2018

graylog2-server/graylog2-server/src/main/java/org/graylog2/rest/resources/tools/LookupTableTesterResource.java

Line 63 in 365d26f

@NoAuditEvent("only used to test lookup tables")

@dennisoelkers
Copy link
Member

@dennisoelkers dennisoelkers commented Jun 25, 2018

Can you elaborate a bit why this check would be necessary? The resource in question is a stub for tests.
@1Jesper1
Copy link
Author

@1Jesper1 1Jesper1 commented Jun 25, 2018

Ah, thought the (live) service was used, so the permission check is needed as it's also used at

graylog2-server/graylog2-server/src/main/java/org/graylog2/rest/resources/system/lookup/LookupTableResource.java

Line 208 in c463959

@RequiresPermissions(RestPermissions.LOOKUP_TABLES_READ)

@no-response no-response bot removed the needs-input label Jun 25, 2018
@bernd bernd added this to the 3.0.0 milestone Jun 28, 2018
@bernd bernd self-assigned this Jun 28, 2018
@bernd
Copy link
Member

@bernd bernd commented Jun 28, 2018

@1Jesper1 Thank you! The check is indeed missing here. This resource is used when editing a lookup table extractor.
bernd added a commit that referenced this issue Jun 28, 2018
@bernd
Add missing LOOKUP_TABLES_READ permission check
d0bf937 
Fixes #4861
@bernd bernd mentioned this issue Jun 28, 2018
Merged
dennisoelkers added a commit that referenced this issue Jun 28, 2018
@bernd @dennisoelkers
Add missing permission checks (#4873)
Loading status checks…
5492f63 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
dennisoelkers added a commit that referenced this issue Jun 28, 2018
@bernd @dennisoelkers
Add missing permission checks (#4873)
Verified
This commit was signed with a verified signature.
dennisoelkers Dennis Oelkers
GPG key ID: 440E58BD30A068C8 Learn about signing commits
Loading status checks…
9613bbf 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
@dennisoelkers dennisoelkers mentioned this issue Jun 28, 2018
Merged
bernd added a commit that referenced this issue Jun 28, 2018
@dennisoelkers @bernd
Add missing permission checks (#4873) (#4878)
Loading status checks…
4f3eb82 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bernd bernd

Labels
bug security
Projects
None yet
Milestone
3.0.0
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
@bernd @dennisoelkers @1Jesper1