This is an automated email from the ASF dual-hosted git repository.
tomsun28 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hertzbeat.git
The following commit(s) were added to refs/heads/master by this push:
new f952d47eb4 [security] Restrict plugin upload endpoint to admin role
(#4149) (#4257)
f952d47eb4 is described below
commit f952d47eb42b6c31c39cf1cd929d7a25741b326b
Author: Bhavya Sonigra <[email protected]>
AuthorDate: Fri Aug 14 23:14:43 2026 +0530
[security] Restrict plugin upload endpoint to admin role (#4149) (#4257)
Signed-off-by: Bhavya Sonigra <[email protected]>
Co-authored-by: Tomsun28 <[email protected]>
---
hertzbeat-startup/src/main/resources/sureness.yml | 4 ++++
.../hertzbeat-postgresql-victoria-metrics/.env.example | 18 ++++++++++++++++++
.../hertzbeat-postgresql-victoria-metrics/.gitignore | 16 ++++++++++++++++
.../docker-compose.yaml | 6 ++++--
4 files changed, 42 insertions(+), 2 deletions(-)
diff --git a/hertzbeat-startup/src/main/resources/sureness.yml
b/hertzbeat-startup/src/main/resources/sureness.yml
index 8cdaeec049..5aa2f8a26e 100644
--- a/hertzbeat-startup/src/main/resources/sureness.yml
+++ b/hertzbeat-startup/src/main/resources/sureness.yml
@@ -60,6 +60,10 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
+ - /api/plugin/**===get===[admin]
+ - /api/plugin/**===post===[admin]
+ - /api/plugin/**===put===[admin]
+ - /api/plugin/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting
stored
# credentials, so it stays admin only and is additionally refused by the
controller
- /api/config/secret===get===[admin]
diff --git
a/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.env.example
b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.env.example
new file mode 100644
index 0000000000..77aa295e58
--- /dev/null
+++ b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.env.example
@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Copy this file to .env and set your own strong password before running
docker compose up
+POSTGRES_USER=root
+POSTGRES_PASSWORD=
diff --git
a/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.gitignore
b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.gitignore
new file mode 100644
index 0000000000..51384e37c9
--- /dev/null
+++ b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/.gitignore
@@ -0,0 +1,16 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+.env
diff --git
a/script/docker-compose/hertzbeat-postgresql-victoria-metrics/docker-compose.yaml
b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/docker-compose.yaml
index 4a581e1afc..60fe377d0d 100644
---
a/script/docker-compose/hertzbeat-postgresql-victoria-metrics/docker-compose.yaml
+++
b/script/docker-compose/hertzbeat-postgresql-victoria-metrics/docker-compose.yaml
@@ -34,8 +34,8 @@ services:
ports:
- '15432:5432'
environment:
- POSTGRES_USER: root
- POSTGRES_PASSWORD: 123456
+ POSTGRES_USER: ${POSTGRES_USER:-root}
+ POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Please set POSTGRES_PASSWORD
(e.g., in .env)}"
TZ: Asia/Shanghai
PGDATA: /var/lib/postgresql/data/pgdata
volumes:
@@ -73,6 +73,8 @@ services:
HERTZBEAT_COLLECTOR_MYSQL_QUERY_ENGINE: auto
TZ: Asia/Shanghai
LANG: zh_CN.UTF-8
+ SPRING_DATASOURCE_USERNAME: ${POSTGRES_USER:-root}
+ SPRING_DATASOURCE_PASSWORD: ${POSTGRES_PASSWORD:?Please set
POSTGRES_PASSWORD in your .env file}
depends_on:
postgres:
condition: service_healthy
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
