Francisco Guerrero created CASSANDRA-21560:
----------------------------------------------
Summary: Validate authz before performing role check
Key: CASSANDRA-21560
URL: https://issues.apache.org/jira/browse/CASSANDRA-21560
Project: Apache Cassandra
Issue Type: Bug
Reporter: Francisco Guerrero
Assignee: Francisco Guerrero
In {{ListPermissionsStatement}} and {{ListRolesStatement}} we perform a role
check existence before ensuring the logged in user has access to list roles or
permissions of that user.
This could allow someone without access to list roles or permissions to check
for existence of a role in the database, as the error message will show {{role
foo does not exist}}.
We should reverse the conditions and perform the validation before performing
the role check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
