[AMQ-8522] Everybody granted full privileges on /api/* in jetty.xml

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.16.4
• Fix Version/s: 5.17.0, 5.16.5
• Component/s: Web Console
• Assignee: Jean-Baptiste Onofré
• Reporter: Carsten Langer
• Created: 03/Mar/22 15:37
• Updated: 07/Mar/22 10:05
• Resolved: 06/Mar/22 06:47

Description

Everybody granted full privileges on /api/* in jetty.xml

Before fixing AMQ-5388, the ContstraintMapping for the "user" role contained the path part "/api/*", thus binding any API call to the "user" role.

With the fix for AMQ-5388 the path part "/api/*" was removed. This has the effect that a request to "/api/message/..." or "/api/jolokia/..." is allowed to everybody.

IMHO the path part "/api/*" should be added back to the ContstraintMapping mapping.

Issue Links

• is caused by: AMQ-5388 User Role Granted Full Privileges in jetty.xml