[STORM-3251] Using Logviewer Filter settings causes anyone to access logs via log viewer REST API

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Labels: pull-request-available
• Assignee: Aaron Gresch
• Reporter: Aaron Gresch
• Created: 11/Oct/18 16:14
• Updated: 12/Oct/18 21:41
• Resolved: 12/Oct/18 21:41

Description

The rest API for logviewer access is checking if UI filter params is set to deny access to users.  It's possible now to configure the logviewer without UI filter params, so this check is no longer sufficient and can allow anyone access to logs.

 

See ResourceAuthorizer line 68....

Issue Links

• links to: GitHub Pull Request #2872