kali834x opened a new pull request, #1314: URL: https://github.com/apache/axis-axis2-java-core/pull/1314
ListingAgent.processListFaultyServices now only passes the service named by `serviceName` to listFaultyService.jsp when it passes the same Utils.isHiddenService / isMetadataExposed check processListServices applies. GET /services/ListFaultyServices?serviceName=X is anonymous and the page renders the service's EPR, documentation and every operation, but the route checked neither control, so a service deployed with exposeServiceMetadata=false or hiddenService=true was withheld from /services/, ?wsdl, ?xsd and the rest yet fully described here to anyone who knows or guesses its name. SECURITY.md lists exposeServiceMetadata as enforced uniformly across the servlet paths, and this was the one route left out. A withheld service now renders the same as an unknown one, so the page doesn't confirm it exists either. ServiceListingFilterTest gets a regression that fails before the change (the NotExposed service reaches the model) and passes after; the transport-http module's verify is green (111 tests). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
