[SLING-12074] ScriptingVariablesConsolePlugin might use wrong security provider

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Scripting Core 2.4.8
• Fix Version/s: Scripting Core 2.4.10
• Component/s: Scripting
• Assignee: Carsten Ziegeler
• Reporter: Carsten Ziegeler
• Created: 05/Oct/23 05:13
• Updated: 16/Oct/23 09:44
• Resolved: 16/Oct/23 09:44

Description

In order to show the variable bindings, the webconsole plugin introduced with SLING-3543 and then refined with SLING-10147 uses a "trick" and actually invokes Sling via a servlet to get the requested information.
The check in the servlet is only checking if there is a WebConsoleSecurityProvider2 registered - it is not checking whether it is the correct one, nor whether that is actually using Sling authentication.
With new features added to the Sling API we can completely remove that default servlet and let the plugin directly call into Sling. This gives a "correct" check, removes the unneeded default servlet and reduces the dependency on the web console.

Issue Links

• links to: GitHub Pull Request #26