yyqdbngt opened a new pull request, #2055: URL: https://github.com/apache/rocketmq-dashboard/pull/2055
## What is the purpose of the change Fix #2045. GET /api/acl/remote/rules was treated as an ordinary reader GET by AuthInterceptor. It is not a passive read of Studio's local store: ApacheAclReadService resolves the selected instance, uses its stored administrative RocketMQ credentials, connects to every broker, and returns live ACL 2.0 subjects, resources and policies. A non-admin reader could therefore trigger broker connections and observe live ACL policy data. ## Brief changelog - AuthInterceptor: require admin for GET /api/acl/remote/rules ## How was this patch verified - Code review: matches the existing admin-only GET path handling for /api/llm/models and credential reveals - `git diff --check` clean -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
