[ATLAS-2009] Any non-admin user in users-credentials.properties is able to access /api/atlas/admin path

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 0.8.1, 1.0.0
• Component/s: atlas-core
• Assignee: Nixon Rodrigues
• Reporter: Sharmadha S
• Created: 31/Jul/17 08:57
• Updated: 07/Aug/17 06:23
• Resolved: 07/Aug/17 06:23

Description

Any non-admin user (ex: rangertagsync) specified in conf/users-credentials.properties is able to access the /api/atlas/admin path. Is this expected ?
One of the use cases is Export and Import API's ,which should be permitted only by admin user to be executed. But any user is able to execute it.