Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Console 端瞬间列表未认证却可以访问 #71

Closed
guqing opened this issue Jan 12, 2024 · 1 comment · Fixed by #81
Closed

Console 端瞬间列表未认证却可以访问 #71

guqing opened this issue Jan 12, 2024 · 1 comment · Fixed by #81
Assignees
@LIlGG
Labels
kind/bug Categorizes issue or PR as related to a bug.

Comments

@guqing
Copy link
Member

guqing commented Jan 12, 2024

目前发现瞬间在 Console 端使用的 list API 可以在未认证的情况下访问，这可能会让用户看到别人发的私有 moment

/kind bug
@f2c-ci-robot f2c-ci-robot bot added the kind/bug Categorizes issue or PR as related to a bug. label Jan 12, 2024
@LIlGG
Copy link
Member

LIlGG commented Feb 20, 2024

/assign

@LIlGG LIlGG mentioned this issue Feb 20, 2024
Merged
f2c-ci-robot bot pushed a commit that referenced this issue Feb 21, 2024
@LIlGG
fix: access the list interface without logging in (#81)
c8f66d0 
#### What type of PR is this?

/kind bug

#### What this PR does / why we need it:

根据 [自定义 API](https://docs.halo.run/developer-guide/plugin/api-reference/server/extension#%E8%87%AA%E5%AE%9A%E4%B9%89-api) 的规则，当 group 为 `api.<group>` 时，此接口默认为为主题端公开的接口。而 moment 在初始定义时，使用了 `api.plugin.halo.run` 作为 group，因此导致其能被公开访问。

本 pr 将 moment 自定义的接口组由 `api.plugin.halo.run` 改为 `console.api.moment.halo.run`，用于解决用户未登录便可访问瞬间列表的问题。

#### How to test it?

未登录状态下，直接访问接口 `/apis/console.api.moment.halo.run/v1alpha1/moments`。 查看是否提示无权限。

#### Which issue(s) this PR fixes:

Fixes #71 

#### Does this PR introduce a user-facing change?
```release-note
解决未认证的用户可以获取瞬间列表的问题
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@LIlGG LIlGG

Labels
kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: access the list interface without logging in LIlGG/plugin-moments
2 participants
@LIlGG @guqing