Graylog2 / Graylog2/graylog2-server

Review resource permission checks

Open
#22,848 0 comments 0 reactions 1 assignee Claimed by @kroepke View on GitHub
bug
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Review the following resources, they might either use too broad a permission check, or lack one entirely.

- [ ] [Lookup Tables](https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/rest/resources/system/lookup/LookupTableResource.java#L108)
- [ ] potentially unused [StatsResource](https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/rest/resources/system/StatsResource.java#L43)
- [ ] potentially unused [ServiceManagerResource](https://github.com/Graylog2/graylog2-server/blob/8ce9b3f5323b52e43c59c26777688015236d4ef9/graylog2-server/src/main/java/org/graylog2/rest/resources/system/jobs/ServiceManagerResource.java#L51)
- [ ] is this ever used unauthenticaed? [PermissionsResource#readerPermissions](https://github.com/Graylog2/graylog2-server/blob/7a289b173f63756ed8969970ea90f3fd46befabe/graylog2-server/src/main/java/org/graylog2/rest/resources/system/PermissionsResource.java#L76)
- [ ] might need a new permission for granular access [OutputResource#available](https://github.com/Graylog2/graylog2-server/blob/ee419553918d1d3c3247e470f435ac0f270b9c22/graylog2-server/src/main/java/org/graylog2/rest/resources/system/outputs/OutputResource.java#L184)
- [ ] [ReportingConfigResource#read](https://github.com/Graylog2/graylog-plugin-enterprise/pull/11097/files#diff-b911a7569edaba52ae723fbae12c3318eb6cc18b9e5f9f1503525dbe56b2087e)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.