lizhimins commented on PR #4003:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4003#issuecomment-5570427011
Closing as a duplicate of #3213.
The defect is real and the fix surface is complete — the read path was the
one remaining gap for this IDOR, and it correctly reuses the mainline
`AuthenticatedUserContext` rather than building its own. But it is the same fix
as #3213: same file, same line, same `QueryWrapper.eq("id").eq("queried_by")`
approach. #3213 was opened about a day earlier and its test is stronger (it
also asserts `getParamNameValuePairs()` contains both the id and the username),
so we are retaining #3213 and closing this one to avoid two copies of the same
change.
Two bits here are worth folding into #3213 as a strengthening follow-up: the
404 response-code assertion and the explanatory Javadoc. Thanks for catching
the same gap, @unbridled-41 — the underlying issue is genuine and will be fixed
via #3213.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
