SOLR-8167: Authorization framework does not work with POST params

git-svn-id: https://svn.apache.org/repos/asf/lucene/dev/trunk@1709056 13f79535-47bb-0310-9956-ffa450edef68
apache · Oct 16, 2015 · ab9e3b9 · ab9e3b9
1 parent d73c904
commit ab9e3b9
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 2 deletions.
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
@@ -274,6 +274,9 @@ Bug Fixes
 
 * SOLR-8050: Partial update on document with multivalued date field fails to parse date and can
   also fail to remove dates in some cases. (Burkhard Buelte, Luc Vanlerberghe, shalin)
+
+* SOLR-8167: Authorization framework does not work with POST params (noble)
+
 
 Optimizations
 ----------------------

diff --git a/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java b/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java
@@ -460,7 +460,7 @@ public static OPERATION get(String name) {
           "    update :{" +
           "      path:'/update/*'}," +
           "    read :{" +
-          "      path:['/update/*', '/get']}," +
+          "      path:['/select', '/get']}," +
           "    config-edit:{" +
           "      method:POST," +
           "      path:'/config/*'}}");

diff --git a/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java b/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java
@@ -957,7 +957,7 @@ else if (params.get(COLLECTION_PROP) != null)
     return new AuthorizationContext() {
       @Override
       public SolrParams getParams() {
-        return getQueryParams();
+        return solrReq.getParams();
       }
 
       @Override

diff --git a/solr/core/src/test/org/apache/solr/security/BasicAuthIntegrationTest.java b/solr/core/src/test/org/apache/solr/security/BasicAuthIntegrationTest.java
@@ -164,6 +164,13 @@ protected void doExtraTests(MiniSolrCloudCluster miniCluster, SolrZkClient zkCli
       fail("must have failed");
     } catch (HttpSolrClient.RemoteSolrException e) {
 
+    }
+    reload.setMethod(SolrRequest.METHOD.POST);
+    try {
+      rsp = solrClient.request(reload);
+      fail("must have failed");
+    } catch (HttpSolrClient.RemoteSolrException e) {
+
     }
     cloudSolrClient.request(new CollectionAdminRequest.Reload()
         .setCollectionName(defaultCollName)