You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2021/02/19 19:24:47 UTC
[GitHub] [trafficcontrol] zrhoffman opened a new issue #5548: GET /servers?dsId=0 returns 403 forbidden
zrhoffman opened a new issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548
<!--
************ STOP!! ************
If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact
the Apache Traffic Control Security Team at security@trafficcontrol.apache.org and follow the
guidelines at https://www.apache.org/security/ regarding vulnerability disclosure.
- For *SUPPORT QUESTIONS*, use the Traffic Control slack (https://s.apache.org/atc-slack)
or Traffic Control mailing lists (https://trafficcontrol.apache.org/mailing_lists).
- Before submitting, please **SEARCH GITHUB** for a similar issue or PR.
-->
## I'm submitting a ...
<!-- delete all those that don't apply -->
<!--- security vulnerability (STOP!! - see above)-->
- bug report
## Traffic Control components affected ...
<!-- delete all those that don't apply -->
- Traffic Ops
## Current behavior:
<!-- Describe how the bug manifests -->
`GET /servers?dsId=0` returns 403 forbidden
```json
{
"alerts": [
{
"text": "Forbidden",
"level": "error"
}
]
}
```
## Expected behavior:
<!-- Describe what the behavior would be without the bug -->
`GET /servers?dsId=0` returns 200 OK with an empty array of servers
## Minimal reproduction of the problem with instructions:
<!--
If the current behavior is a bug, please provide the *STEPS TO REPRODUCE* and
include the applicable TC version.
-->
1. Log in
2. `GET /api/4.0/servers?dsId=0` returns 200 OK with an empty array of servers
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
https://apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mitchell852 edited a comment on issue #5548: GET /servers?dsId=0 returns 403 forbidden
Posted by GitBox <gi...@apache.org>.
mitchell852 edited a comment on issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548#issuecomment-782304060
i guess its just doing the tenancy check huh? and ds=0 is in nobody's tenancy scope...hence the 403 Forbidden
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mitchell852 commented on issue #5548: GET /servers?dsId=0 returns 403 forbidden
Posted by GitBox <gi...@apache.org>.
mitchell852 commented on issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548#issuecomment-782304060
i guess its just doing the tenancy check huh? and ds=0 is in nobody's tenancy scope...
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] ocket8888 closed issue #5548: GET /servers?dsId={{nonexistent DS ID}} returns 403 forbidden
Posted by GitBox <gi...@apache.org>.
ocket8888 closed issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] zrhoffman commented on issue #5548: GET /servers?dsId=0 returns 403 forbidden
Posted by GitBox <gi...@apache.org>.
zrhoffman commented on issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548#issuecomment-782324977
It returns 403 Forbidden for any non-existent dsId like 999999
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] srijeet0406 commented on issue #5548: GET /servers?dsId={{nonexistent DS ID}} returns 403 forbidden
Posted by GitBox <gi...@apache.org>.
srijeet0406 commented on issue #5548:
URL: https://github.com/apache/trafficcontrol/issues/5548#issuecomment-789853078
@zrhoffman I can take this one
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org