[ROL-1983] Only expose AJAX User List Servlet to admin users

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.0.3, 5.1.0
• Fix Version/s: 5.0.4, 5.1.0
• Component/s: User Management
• Assignee: Glen Mazza
• Reporter: Glen Mazza
• Created: 08/Jan/14 03:25
• Updated: 25/Aug/14 17:56
• Resolved: 19/Feb/14 12:06

Description

For some reason the Roller user list is presently implemented via a servlet, allowing the list of blog users and email addresses to be publicly accessible for those accessing the URL. Goal here is to shut off the servlet and use a traditional Struts/JPA method of listing the users on the page, perhaps similar to our blog entry listing screen.

UPDATE: there's nothing wrong with using a Servlet for this AJAX operation, but we should only expose the Servlet to those who are logged into Roller as site admins.