Skip to content

Commit af196a9

Browse files
committed
fix: user with system audit permissions can read all system permissions
1 parent 87b7c63 commit af196a9

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

opal-core-ws/src/main/java/org/obiba/opal/core/security/AdministrationPermissionConverter.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ public Iterable<String> convert(String node) {
6969
toRest("/service/r/clusters", "GET"),
7070
toRest("/service/r/activity/_summary", "GET"),
7171
toRest("/system/subject-profile", "GET:GET/GET"),
72-
toRest("/system/permissions/datashield", "GET"),
72+
toRest("/system/permissions", "GET:GET/GET"),
7373
toRest("/system/log/datashield.log", "GET"),
7474
toRest("/datashield/profile", "GET:GET/GET"),
7575
toRest("/datashield/env", "GET:GET/GET"),

opal-core-ws/src/test/java/org/obiba/opal/core/security/AdministrationPermissionConverterTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public void testAuditAll() {
4747
"rest:/service/r/clusters:GET",
4848
"rest:/service/r/activity/_summary:GET",
4949
"rest:/system/subject-profile:GET:GET/GET",
50-
"rest:/system/permissions/datashield:GET",
50+
"rest:/system/permissions:GET:GET/GET",
5151
"rest:/system/log/datashield.log:GET",
5252
"rest:/datashield/profile:GET:GET/GET",
5353
"rest:/datashield/env:GET:GET/GET",

0 commit comments

Comments
 (0)