centreon / centreon-archived

Centreon is a network, system and application monitoring tool. Centreon is the only AIOps Platform Providing Holistic Visibility to Complex IT Workflows from Cloud to Edge.
https://www.centreon.com
GNU General Public License v2.0
575 stars 240 forks source link

fix(api): restrain access to provider configurations with menu access #11934

Closed jeremyjaouen closed 1 year ago

jeremyjaouen commented 1 year ago

Description

This PR intends to restraint access to provider configurations endpoint taking account of menu access

Fixes # MON-15253

Type of change

Target serie

How this pull request can be tested ?

Create a user

Give him Reach Api Configuration right

Give him no ACL

Connect to API v2 with this user

call GET / PUT /administration/authentication/providers/local

call GET / PUT /administration/authentication/providers/openid

call GET / PUT /administration/authentication/providers/web-sso

The request should return a 403 and the listing or update not occurs.

Give user ACL Menu Access to Authentication

call GET / PUT /administration/authentication/providers/local

call GET / PUT /administration/authentication/providers/openid

call GET / PUT /administration/authentication/providers/web-sso

The user is able to list or modify the provider configurations

Checklist

Community contributors & Centreon team

sonarqube-decoration[bot] commented 1 year ago

SonarQube Quality Gate

Quality Gate passed

Bug E 11 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots (100.0% 100.0% reviewed)
Code Smell A 3349 Code Smells

0.0% 0.0% Coverage
4.3% 4.3% Duplication