Bhavya-Sonigra opened a new pull request, #4257: URL: https://github.com/apache/hertzbeat/pull/4257
Fixes #4149 ## What's changed? The `/api/plugin` endpoint had no role-based access control in `sureness.yml`, unlike every other API path in the file. Since plugin upload loads custom JAR code into the JVM via ServiceLoader, this meant any authenticated (or in some cases unauthenticated) user could manage plugins with the same access as an admin. This PR adds explicit admin-only role mappings for `/api/plugin/**`, following the exact pattern used elsewhere in the file: - /api/plugin/**===get===[admin] - /api/plugin/**===post===[admin] - /api/plugin/**===put===[admin] - /api/plugin/**===delete===[admin] Tested locally: - Request to `/api/plugin` with no auth token → `401 Unauthorized` - Request to `/api/plugin` with an admin token → `200 OK` with expected data ## Checklist - [x] I have read the Contributing Guide - [ ] I have written the necessary doc or comment. - [ ] I have added the necessary unit tests and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
