Commits on Feb 25, 2020

1. server: return HTTP 403 instead of 500 upon authz failures …

   Before, the HTTP endpoints would return 500 (Internal server error)
   when they require an admin user and a non-admin user was logged in.
   This patch changes it to make them return 403 (Forbidden) instead,
   which is the standard "permission denied" error code.
   
   Release note (general change): HTTP endpoints now report status
   403 (Forbidden) instead of 500 (Internal server error) when the
   authenticated user has insufficient privileges to use the endpoint.

   

   knz committed Feb 25, 2020
   Copy the full SHA

   111a9c8 View commit details

   Browse the repository at this point in the history

2. roleccl: enable GRANT/REVOKE for roles without a license …

   Release note (security update): Non-licensed users are now
   able to add more principals to the special superuser role/group
   `admin`. (Creation of additional roles is still a licensed feature).
   
   Release note (sql change): It is now possible to use `GRANT` and
   `REVOKE` to add users to the `admin` role without a valid
   license. This change aims to enable use of the admin UI and other
   privileged features without a license.

   

   knz committed Feb 25, 2020
   Copy the full SHA

   db1ea84 View commit details

   Browse the repository at this point in the history