[dev.icinga.com #2305] API access without credentials possible

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/2305

Created by leistenbruchhenry on 2012-02-07 15:11:11 +00:00

Assignee: mhein
Status: Resolved (closed on 2012-02-10 10:53:05 +00:00)
Target Version: 1.6.2
Last Update: 2012-02-10 10:53:05 +00:00 (in Redmine)

---

A logged in user without any given credentials, roles and not member of any groups is able to access api data. I tried the following url (from wiki) in firefox and it was working:

/icinga-web/web/api/service/filter[AND(HOST_CURRENT_STATE|=|0;OR (SERVICE_CURRENT_STATE|=|1;SERVICE_CURRENT_STATE|=|2))]/columns(SERVICE_NAME|HOST_NAME|SERVICE_CURRENT_STATE|HOST_NAME|HOST_CURRENT_STATE|HOSTGROUP_NAME)/order(SERVICE_CURRENT_STATE;DESC)/countColumn=SERVICE_ID/authkey=APITEST123456/xml

I did not set any authkey btw. (which isn't necessary, just wanted to mention it)

Changesets

2012-02-08 13:00:37 +00:00 by jmosshammer 0c238c2

* Additional credential check in API (fixes #2305)

[icinga-migration]

Updated by tgelf on 2012-02-08 09:46:10 +00:00

I can confirm this behavior.

[icinga-migration]

Updated by mhein on 2012-02-08 11:46:51 +00:00

• Target Version set to 1.7

[icinga-migration]

Updated by mhein on 2012-02-10 09:23:17 +00:00

• Target Version changed from 1.7 to 1.6.2

[icinga-migration]

Updated by mhein on 2012-02-10 10:42:25 +00:00

• Assigned to set to mhein

[icinga-migration]

Updated by mhein on 2012-02-10 10:53:05 +00:00

• Status changed from New to Resolved

Fixed by JM