[
https://issues.apache.org/jira/browse/AMQ-5160?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13987276#comment-13987276
]
ASF GitHub Bot commented on AMQ-5160:
-------------------------------------
GitHub user dhirajsb opened a pull request:
https://github.com/apache/activemq/pull/21
Fix for AMQ-5160, add support for wildcard destination authorization
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/dhirajsb/activemq trunk
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/activemq/pull/21.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #21
----
commit 071c2d30ba5b497a66937c724605d18d04a7e516
Author: Dhiraj Bokde <[email protected]>
Date: 2014-05-01T18:21:50Z
Initial fix for AMQ-5160 to support subscription authorization for
destination filters
commit 2b6758c822a90ea6f78501c86b397e0d6550fb56
Author: Hadrian Zbarcea <[email protected]>
Date: 2014-05-01T19:25:31Z
Temporarily disable failing test
commit 343c90415aca46f450ed493219facf6812a6dad9
Author: Dhiraj Bokde <[email protected]>
Date: 2014-05-02T02:13:01Z
Fixed AMQ-5160, allowed wildcard subscriptions for future destinations,
added tests for wildcard authorization, fixed consumer and producer
AdvisoryTopic names for composite destinations by replacing ',' with '‚'
----
> Wildcard subscriptions bypass Authentication / Authorization
> ------------------------------------------------------------
>
> Key: AMQ-5160
> URL: https://issues.apache.org/jira/browse/AMQ-5160
> Project: ActiveMQ
> Issue Type: Bug
> Components: MQTT
> Affects Versions: 5.9.1
> Reporter: Surf
> Priority: Critical
> Labels: authentication, authorization, mqtt, security
> Attachments: activemq.xml, groups.properties, login.config,
> users.properties
>
>
> I am using MQTT on AMQ 5.9.1
> After latest MQTT hardening from [~dhirajsb] , there is an issue of MQTT
> retained messages.
> Simple case:
> Set Authentication / Authorization for two different TOPICS.
> Send retained message to one topic.
> Try to subscribe "#" with other second user.
> It will show retained messages published by TOPIC 1.
> here i have attached test configurations.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
