[
https://issues.apache.org/jira/browse/KNOX-3410?focusedWorklogId=1035078&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035078
]
ASF GitHub Bot logged work on KNOX-3410:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Aug/26 11:09
Start Date: 11/Aug/26 11:09
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1343:
URL: https://github.com/apache/knox/pull/1343
…rization
[KNOX-3410](https://issues.apache.org/jira/browse/KNOX-3410) - KnoxToken
enable/disable endpoints perform no caller authorization
## What changes were proposed in this pull request?
The KnoxToken enable/disable endpoints (enable, disable, enableTokens,
disableTokens) flipped any token's enabled flag with no authorization check —
any authenticated user could disable/re-enable another user's tokens. Fixed by
gating `setTokenEnabledFlag` on the same check `revoke()` already uses: caller
must own the token (`triesToRevokeOwnToken`) or be in the renewer/group
whitelist (`tokenRenewalOrRevocationAuthorized`), else 403.
## How was this patch tested?
Unit tests
Tested locally by adding KNOXTOKEN to sandbox topology
```
curl -vku admin:admin-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
curl -vku guest:guest-password -X "GET"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
curl -vk -d "tokenId" -u admin:admin-password -X "PUT"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/disable";
curl -vk -d "tokenId" -u admin:admin-password -X "DELETE"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/revoke";
curl -vk -d "tokenId" -u guest:guest-password -X "DELETE"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/revoke";
curl -vk -d "tokenId" -u guest:guest-password -X "PUT"
"https://localhost:8443/gateway/sandbox/knoxtoken/api/v2/token/disable";
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1035078)
Remaining Estimate: 0h
Time Spent: 10m
> KnoxToken enable/disable endpoints perform no caller authorization
> ------------------------------------------------------------------
>
> Key: KNOX-3410
> URL: https://issues.apache.org/jira/browse/KNOX-3410
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
