Bug 1343516
Summary: | Cloudforms role-based access controls (RBAC) allow a user to view requests using the REST API end-point when they do not have the required permissions | ||
---|---|---|---|
Product: | Red Hat CloudForms Management Engine | Reporter: | John Prause <jprause> |
Component: | API | Assignee: | Tim Wade <twade> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | Martin Kourim <mkourim> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 5.5.0 | CC: | cpelland, jhardy, obarenbo, simaishi |
Target Milestone: | GA | Keywords: | ZStream |
Target Release: | 5.6.1 | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | rbac:rest | ||
Fixed In Version: | 5.6.1.0 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | 1340311 | Environment: | |
Last Closed: | 2016-11-18 15:14:25 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | CFME Core | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1297974, 1340311 | ||
Bug Blocks: |
Comment 2
Satoe Imaishi
2016-11-04 20:41:32 UTC
Verified using steps in bug description. Resulted in { "error": { "kind": "forbidden", "message": "Use of the read action is forbidden", "klass": "ApiController::Forbidden" } } |