[jira] [Work logged] (AMQ-8522) Everybody granted full privileges on /api/* in jetty.xml

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/AMQ-8522?focusedWorklogId=736148&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-736148 ]

ASF GitHub Bot logged work on AMQ-8522:
---------------------------------------

                Author: ASF GitHub Bot
            Created on: 03/Mar/22 16:51
            Start Date: 03/Mar/22 16:51
    Worklog Time Spent: 10m 
      Work Description: jbonofre commented on pull request #790:
URL: https://github.com/apache/activemq/pull/790#issuecomment-1058254122


   This PR will need to be rebased on #789 when complete.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

            Worklog Id:     (was: 736148)
    Remaining Estimate: 0h
            Time Spent: 10m

> Everybody granted full privileges on /api/* in jetty.xml
> --------------------------------------------------------
>
>                 Key: AMQ-8522
>                 URL: https://issues.apache.org/jira/browse/AMQ-8522
>             Project: ActiveMQ
>          Issue Type: Bug
>          Components: Web Console
>    Affects Versions: 5.16.4
>            Reporter: Carsten Langer
>            Assignee: Jean-Baptiste Onofré
>            Priority: Major
>             Fix For: 5.17.0, 5.16.5
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> Everybody granted full privileges on {{/api/*}} in jetty.xml
> Before fixing AMQ-5388, the ContstraintMapping for the "user" role contained the path part {{{}"/api/*"{}}}, thus binding any API call to the "user" role.
> With the fix for AMQ-5388 the path part {{"/api/*"}} was removed. This has the effect that a request to {{"/api/message/..."}} or {{"/api/jolokia/..."}} is allowed to everybody.
> IMHO the path part {{"/api/*"}} should be added back to the ContstraintMapping mapping.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)