Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API: individual node access permissions are not checked when querying project nodes #2265

Closed
gschueler opened this issue Jan 6, 2017 · 1 comment
Closed

API: individual node access permissions are not checked when querying project nodes #2265

gschueler opened this issue Jan 6, 2017 · 1 comment
Assignees
@gschueler
Labels
bug
Milestone
2.7.2

Comments

@gschueler
Copy link
Member

Bug report

My Rundeck detail

  • Rundeck version: 2.7.1 and earlier

Expected Behavior

Using the List resources API (http://rundeck.org/docs/api/#listing-resources), the results should not include Nodes where run access is not granted to the user.

Actual Behavior

The List resources API returns all nodes in the project.

How to reproduce Behavior

curl -H x-rundeck-auth-token:xyz http://rundeck:4440/api/18/project/MyProject/resources
@gschueler gschueler added this to the 2.7.2 milestone Jan 6, 2017
@gschueler
Copy link
Member Author

gschueler commented Jan 6, 2017 •
edited
Loading

Note: read is required for resource: kind: node within the project, but individual node access is not validated

@gschueler gschueler mentioned this issue Jan 6, 2017
Closed
@gschueler gschueler self-assigned this Jan 7, 2017
gschueler added a commit that referenced this issue Jan 11, 2017
@gschueler
Merge pull request #2266 from rundeck/rundeck-2265
3a32d64 
fix #2265 require read auth for individual nodes in api results
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gschueler gschueler

Labels
bug
Projects
None yet
Milestone
2.7.2
Development

No branches or pull requests
1 participant
@gschueler