Enforce clusterconfiguration:read permission on Cluster Configuration endpoints (7.1)#25881
Open
graylog-internal-actions-access[bot] wants to merge 1 commit into7.1from
Conversation
… endpoints (#25754) * Enforce clusterconfiguration:read permission on ClusterResource endpoints The Cluster Configuration page was accessible via direct URL even for users without the "Cluster Configuration Reader" role because the backend endpoints had no permission checks — only the nav menu item was gated. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add changelog entry for PR #25754 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add permission guard to ClusterConfigurationPage Redirect users without clusterconfiguration:read to the Not Found page when they navigate directly to the Cluster Configuration URL. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * allow /nodes since UI needs it --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Tomas Dvorak <tomas.dvorak@graylog.com> (cherry picked from commit 56bcada)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note: This is a backport of #25754 to
7.1.Relates to Graylog2/glc-bd-documents#85
Description
After the upgrade from 6.3 to 7.0, the "Cluster Configuration Reader" role was introduced in #23248 to restrict access to the Cluster Configuration page. However, the
clusterconfiguration:readpermission was only enforced on the navigation menu item — theClusterResourceREST endpoints had no permission checks, allowing any authenticated user to access/system/clusterdata directly.This PR adds
@RequiresPermissions(RestPermissions.CLUSTER_CONFIGURATION_READ)to theseClusterResourceGET endpoints:GET /system/cluster/nodes/paginatedGET /system/cluster/nodeGET /system/cluster/nodes/{nodeId}We do not restrict
GET /system/cluster/nodessince the UI is unusable without it. It only exposes basic information about nodes, unlike the more detailed paginated endpoint.The PR also adds a frontend route guard on
ClusterConfigurationPageto redirect users withoutclusterconfiguration:readto a 404.How Tested
/api/system/cluster/nodes— should now return 403Types of changes
Checklist