Uploaded image for project: 'Red Hat Fuse'
  1. Red Hat Fuse
  2. ENTESB-4996

Viewer role able to create/delete queues and messages via Hawtio

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Done
    • Affects Version/s: jboss-fuse-6.2.1
    • Component/s: Hawtio
    • Labels:
      None
    • Environment:
      • JBoss Fuse 6.2.1
      • JBoss AMQ 6.2.1
    • Sprint:
      6.3 Sprint 4 (Mar 28 - Apr 29)
    • Steps to Reproduce:
      Hide

      1) Create a user in etc/users.properties with only the viewer role
      2) Start the container
      3) Login to the Hawtio with the user having only the viewer role
      4) Select the ActiveMQ view
      5) Using a client, connect to the broker to create a new queue
      6) In Hawtio, observe the user with the viewer role can now create additional queues and delete the queue created
      7) Logout of the Hawtio
      8) Login to the Hawtio with the user with only the viewer role
      9) Select the ActiveMQ view
      10) Observe the user no longer has access to create or delete queues
      11) Create an additional queue with the client
      12) Observe the user in Hawtio can again create and delete queues

      Using similar steps the user with the viewer role can also delete messages from queues

      Show
      1) Create a user in etc/users.properties with only the viewer role 2) Start the container 3) Login to the Hawtio with the user having only the viewer role 4) Select the ActiveMQ view 5) Using a client, connect to the broker to create a new queue 6) In Hawtio, observe the user with the viewer role can now create additional queues and delete the queue created 7) Logout of the Hawtio 8) Login to the Hawtio with the user with only the viewer role 9) Select the ActiveMQ view 10) Observe the user no longer has access to create or delete queues 11) Create an additional queue with the client 12) Observe the user in Hawtio can again create and delete queues Using similar steps the user with the viewer role can also delete messages from queues

      Description

      A user with viewer role is capable of creating and deleting AMQ queues via Hawtio. This issue becomes apparent after a new queue is created from a client connected to the broker and when the Hawtio UI refreshes to display the new queue. After the refresh of Hawtio, the create queue and delete queue options are enabled. If the user logs out and logs back in the options are no longer available.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  tadayosi Tadayoshi Sato
                  Reporter:
                  jsherman Jason Sherman
                • Votes:
                  1 Vote for this issue
                  Watchers:
                  10 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: