Description of problem: The admin pages for key types and power types do not perform any access checks. An authenticated user can visit these URLs directly (they do not appear in the menu for non-admins) and modify power types and key types. Version-Release number of selected component (if applicable): probably all Beaker versions How reproducible: easily Steps to Reproduce: 1. Go to $BEAKER/powertypes/ without logging in 2. Create or remove power types 3. Go to $BEAKER/keytypes/ without logging in 4. Create or remove key types Actual results: All operations are allowed. Expected results: We can probably allow anonymous users to list the key types and power types as this would be generally useful (and is not sensitive information). However modifications should not be permitted except by admins.
Created attachment 1020383 [details] proposed patch
Created attachment 1020388 [details] proposed patch
Created attachment 1020389 [details] proposed patch
Verified this issue. The result is PASS. Version: Beaker 20.1.git.5.24dc482 Steps to Reproduce: 1. Go to $BEAKER/powertypes/ without logging in 2. Create or remove power types 3. Go to $BEAKER/keytypes/ without logging in 4. Create or remove key types Result: server give 403 response.
Beaker 20.1 has been released.