[OFBIZ-13130] [CVE-2024-45195] Add permission check for view-maps and change defaults for request-maps

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 18.12.15
• Fix Version/s: 18.12.16
• Component/s: ALL APPLICATIONS, ALL COMPONENTS, ALL PLUGINS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Sebastian Tschikin
• Reporter: Sebastian Tschikin
• Created: 14/Aug/24 14:07
• Updated: 05/Sep/24 09:18
• Resolved: 03/Sep/24 06:59

Description

If a user is not authorized, the system should not allow access to rendered views.

Additionally, the default for the request-map paramerters "auth" and "https" should be set to "true".

This improvement aims to enhance security by preventing unauthorized access.

Issue Links

• links to: GitHub Pull Request #126
• links to: GitHub Pull Request #831