luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Prevent Requests to resultant-acl Endpoint When Unauthenticated (#17139) 

* prevents requests to resultant-acl endpoint when not logged in

* removes unauthenticated mentions from resultant-acl api doc

* adds changelog entry
This commit is contained in:
Jordan Reimer 2022-09-15 12:45:33 -06:00 committed by GitHub
parent 87350f927f
commit d258740f24
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changelog/17139.txt Normal file
View File

@ -0,0 +1,6 @@
```release-note:improvement
ui: Prevents requests to /sys/internal/ui/resultant-acl endpoint when unauthenticated
```
```release-note:improvement
website/docs: Removes mentions of unauthenticated from internal ui resultant-acl doc
```

4
ui/app/routes/vault/cluster.js
View File

@ -72,7 +72,9 @@ export default Route.extend(ModelBoundaryRoute, ClusterRoute, {
const id = this.getClusterId(params);
if (id) {
this.auth.setCluster(id);
await this.permissions.getPaths.perform();
if (this.auth.currentToken) {
await this.permissions.getPaths.perform();
}
return this.version.fetchFeatures();
} else {
return reject({ httpStatus: 404, message: 'not found', path: params.cluster_name });

7
website/content/api-docs/system/internal-ui-resultant-acl.mdx
View File

@ -8,11 +8,10 @@ description: >-
# `/sys/internal/ui/resultant-acl`
The `/sys/internal/ui/resultant-acl` endpoint is used to expose resultant-acl
to the UI so that it can change its behavior in response, even before a user logs in.
to the UI so that it can change its behavior in response.
This is currently only being used internally for the UI and is
an unauthenticated endpoint. Due to the nature of its intended usage, there is no
guarantee on backwards compatibility for this endpoint.
This is currently only being used internally for the UI. Due to the nature of its
intended usage, there is no guarantee on backwards compatibility for this endpoint.
## Get Resultant-acl