chibenwa opened a new pull request, #3147:
URL: https://github.com/apache/james-project/pull/3147
`password.nodelete` was introduced alongside `password.readonly` and never
released. It promised that such a credential "can read and create/modify data
but cannot delete", but the filter only compares the literal HTTP method, while
WebAdmin models plenty of destructive operations as POST or PUT:
- `POST /users/{username}?action=deleteData` and `POST
/domains/{domainName}?action=deleteData` erase user data through a task,
- `PUT /users/{username}` resets the password of an existing account, which
is a full account takeover,
- `PUT /domains/{domain}/aliases/{alias}` and the forward routes reroute
mail.
Making the filter action-aware would only paper over this: on an
administration API where creating and updating is as destructive as deleting,
"everything but the DELETE verb" cannot be a privilege separation, merely a
guard-rail against mistyped `curl` commands - one that reads as a security
boundary and is documented as one.
So drop the level rather than keep a boundary we cannot honour. `password`
(full access) and `password.readonly` (GET/HEAD only) remain, the latter being
sound since no WebAdmin GET route mutates state.
Genuine partial privileges need an authenticated administrator identity and
a per-route, per-parameter authorization model - neither of which WebAdmin has,
and both of which belong in a reverse proxy in front of it rather than in a
verb filter inside James. The documentation now says so instead of advertising
a delete/no-delete separation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
