/graylog2-server

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check for RestPermissions.LOOKUP_TABLES_READ #4861

Closed
1Jesper1 opened this Issue Jun 23, 2018 · 3 comments

Comments

Assignees

@bernd bernd

Labels
Projects
None yet
Milestone
  3.0.0
3 participants
@1Jesper1 @dennisoelkers @bernd
@1Jesper1

1Jesper1 commented Jun 23, 2018

graylog2-server/graylog2-server/src/main/java/org/graylog2/rest/resources/tools/LookupTableTesterResource.java

Line 63 in 365d26f

@NoAuditEvent("only used to test lookup tables")

@dennisoelkers

This comment has been minimized.

Sign in to view
Member

dennisoelkers commented Jun 25, 2018

Can you elaborate a bit why this check would be necessary? The resource in question is a stub for tests.

@dennisoelkers dennisoelkers added the needs-input label Jun 25, 2018

@1Jesper1

This comment has been minimized.

Sign in to view

1Jesper1 commented Jun 25, 2018

Ah, thought the (live) service was used, so the permission check is needed as it's also used at

graylog2-server/graylog2-server/src/main/java/org/graylog2/rest/resources/system/lookup/LookupTableResource.java

Line 208 in c463959

@RequiresPermissions(RestPermissions.LOOKUP_TABLES_READ)

@no-response no-response bot removed the needs-input label Jun 25, 2018

@bernd bernd added bug security labels Jun 28, 2018

@bernd bernd added this to the 3.0.0 milestone Jun 28, 2018

@bernd bernd self-assigned this Jun 28, 2018

@bernd

This comment has been minimized.

Sign in to view
Member

bernd commented Jun 28, 2018

@1Jesper1 Thank you! The check is indeed missing here. This resource is used when editing a lookup table extractor.

bernd added a commit that referenced this issue Jun 28, 2018

@bernd
Add missing LOOKUP_TABLES_READ permission check 
Fixes #4861
d0bf937

@bernd bernd referenced this issue Jun 28, 2018

Merged

Add missing permission checks #4873

@dennisoelkers dennisoelkers closed this in #4873 Jun 28, 2018

dennisoelkers added a commit that referenced this issue Jun 28, 2018

@bernd @dennisoelkers
Add missing permission checks (#4873) 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
Loading status checks…
5492f63

dennisoelkers added a commit that referenced this issue Jun 28, 2018

@bernd @dennisoelkers
Add missing permission checks (#4873) 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
Verified
This commit was signed with a verified signature.
@dennisoelkers dennisoelkers Dennis Oelkers
GPG key ID: 440E58BD30A068C8 Learn about signing commits
Loading status checks…
9613bbf

@dennisoelkers dennisoelkers referenced this issue Jun 28, 2018

Merged

Add missing permission checks #4878

bernd added a commit that referenced this issue Jun 28, 2018

@dennisoelkers @bernd
Add missing permission checks (#4873) (#4878) 
* Add missing LOOKUP_TABLES_READ permission check

Fixes #4861

* Check permissions for recent log messages API endpoint

Fixes #4859
Loading status checks…
4f3eb82
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment