You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2019/11/05 19:05:48 UTC

[GitHub] [trafficcontrol] mitchell852 commented on issue #4083: No Error when child tenant accesses parent tenant's delivery-services

mitchell852 commented on issue #4083: No Error when child tenant accesses parent tenant's delivery-services 
URL: https://github.com/apache/trafficcontrol/issues/4083#issuecomment-549971764
 
 
   I'm pretty sure GET /deliveryservices/4 where id=4 is not in your tenancy has always resulted in a 403 forbidden
   
   Or any tenantable resource for that matter. ie.
   
   GET /deliveryservices/4 <-- 403
   GET /deliveryservices/4/servers <-- 403
   GET /users/34 <-- 403
   GET /users/34/deliveryservices <-- 403
   GET /tenants/44 <-- 403
   GET /origins/88 <-- 403
   
   yes, that approach "leaks" info to the user in the sense that now the user knows that ds=4 exists but that's just the way it has always been in 1.x.
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services