[JS1-421] [FIX] Administrative functions not secured

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4b5-dev / CVS
• Fix Version/s: 1.5
• Component/s: Security
• Environment: Operating System: Windows NT/2K; Platform: PC
• Bugzilla Id: 24939
• Assignee: Mark Orciuch
• Reporter: Olaf Romanski
• Created: 24/Nov/03 20:16
• Updated: 02/Apr/04 18:52
• Resolved: 02/Apr/04 17:57

Description

Here is what I do (using nightly build from 09.09.2003):
1. Create a new user (initially has USER role only)
2. Log on to Jetspeed with that user's name
3. Enter one of the following URL's into my browser:

http://localhost:8080/jetspeed/portal/template/Home/template/Home?
action=portlets.PortletUpdateAction&eventSubmit_doDelete=true&portlet_name=portl
et_to_be_deleted

and

http://localhost:8080/jetspeed/portal/template/Home/template/Home?
action=portlets.security.PermissionUpdateAction&eventSubmit_doInsert=true&name=i
nserted_permission_name

Result is:
Having only USER role I deleted portlet 'portlet_to_be_deleted' from portlet
registry and added new permission 'inserted_permission_name'
Should be:
Some message about unauthorized access attempt should be displayed, or at least
protected resources should not be modified.