brettgervasoni opened a new pull request, #4054: URL: https://github.com/apache/hertzbeat/pull/4054
## What's changed? In the script/sureness.yml file there is a typo in the permission definitions for one of the DELETE calls. Instead of using three equals signs, two were used. This is invalid and defaults to the lower levelled user (a standard user), being able to call the DELETE verb when only an admin user is expected to be able to perform this operation. By default, Sureness defaults to allow. This is a low severity security issue. As a result, a non-admin user can use the DELETE verb to delete monitors. I've rectified this by simply fixing the typo'd definition. ## Checklist - [x] I have read the [Contributing Guide](https://hertzbeat.apache.org/docs/community/code_style_and_quality_guide) - [x] I have written the necessary doc or comment. - [x] I have added the necessary unit tests and all cases have passed. ## Add or update API - [x] I have added the necessary [e2e tests](https://github.com/apache/hertzbeat/tree/master/e2e) and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
