bamaer opened a new issue, #8150: URL: https://github.com/apache/hop/issues/8150
### Apache Hop version? 2.20.0-SNAPSHOT ### Java version? 21 ### Operating system Linux ### What happened? When Hop Web is started with authentication and RBAC, a user with the `READ_ONLY` role can only view workflows, pipelines in hop web, but can't edit or execute anything. However, all Hop Server are also available in the default Hop Web image, and are wide open, there's no RBAC implementation at all for these endpoints. This means that a user with a READ_ONLY role still can add and execute workflows, pipelines and metadata items. As an immediate mitigation (not a fix), we could temporarily remove the Server servlets from web.xml. ### Issue Priority Priority: 1 ### Issue Component Component: Hop Web -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
