[jira] [Comment Edited] (AMQ-8522) Everybody granted full privileges on /api/* in jetty.xml

["Christopher L. Shannon (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AMQ-8522?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17500858#comment-17500858 ] 

Christopher L. Shannon edited comment on AMQ-8522 at 3/3/22, 4:18 PM:
----------------------------------------------------------------------

[~jbonofre] - Can you take a look at this? Looks like you had reviewed/merged in AMQ-5388


was (Author: christopher.l.shannon):
[~jbonofre] - Can you take a look at this?

> Everybody granted full privileges on /api/* in jetty.xml
> --------------------------------------------------------
>
>                 Key: AMQ-8522
>                 URL: https://issues.apache.org/jira/browse/AMQ-8522
>             Project: ActiveMQ
>          Issue Type: Bug
>          Components: Web Console
>    Affects Versions: 5.16.4
>            Reporter: Carsten Langer
>            Assignee: Jean-Baptiste Onofré
>            Priority: Major
>             Fix For: 5.17.0, 5.16.5
>
>
> Everybody granted full privileges on {{/api/*}} in jetty.xml
> Before fixing AMQ-5388, the ContstraintMapping for the "user" role contained the path part {{{}"/api/*"{}}}, thus binding any API call to the "user" role.
> With the fix for AMQ-5388 the path part {{"/api/*"}} was removed. This has the effect that a request to {{"/api/message/..."}} or {{"/api/jolokia/..."}} is allowed to everybody.
> IMHO the path part {{"/api/*"}} should be added back to the ContstraintMapping mapping.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)