On 8 September 2014 04:27, Christopher Fairhall <
[email protected]> wrote:
> We've got an Isis application that has failed a security review.
>
> The security provider is Shiro. The UI is Wicket.
>
> When a user with an admin role logs in, they get access to functionality
> not available to standard users.
> However, if a standard user types in the URL to one of the admin pages,
> they get access to it.
>
>
Is the URL for an entity? Or the URL for a (query) action?
> It appears the permissions are only checked when rendering the menus
... or rendering any member of any object (entity or service).
So there is a possible gap... the user could enter the URL of an entity and
discover that such an entity exists as an object. However, authorization
could be setup so that they just see a blank page.
That said, there is the possibility that information could "leak out" in
the title, because that would also be rendered and we don't have any
security for that. As a workaround, you could use the WrapperFactory to
enforce security in such cases, eg:
public String title() {
Customer wrapped = wrapperFactory.wrap(this);
return wrapped.getFirstName() + " " + wrapped.getLastName();
}
> and not when executing the action.
>
I need to check on that, it's possibly an omission. Haven't got time to do
so right now, but will look at this eve.
> Essentially any authenticated user can bypass authorisation.
>
> The permissions are correctly checked when accessing the services through
> the Restful interface.
>
> Is this a known issue?
If the URL you are pasting in is for a query action, and it is firing, then
you have indeed found an issue.
If the URL you are pasting in is for an entity, then I don't think there is
an issue, you just need to lock down permissions on the target object (see
above).
> I did not see anything in the 1.4, 1.5 or 1.6 release notes that would
> cover it either.
>
>
You are correct that there's been no change in 1.4, 1.5, 1.6. If there
is an issue in that a query action fires, we will of course fix it for you.
Let me know...
Dan
>
> -------------------------------
> This email and any attachments may contain information that is
> confidential and subject to legal privilege. If you are not the intended
> recipient, any use, dissemination, distribution or duplication of this
> email and attachments is prohibited. If you have received this email in
> error please notify the author immediately and erase all copies of the
> email and attachments. The Ministry of Social Development accepts no
> responsibility for changes made to this message or attachments after
> transmission from the Ministry.
>
> -------------------------------
>
