Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ACL check auth bugs when http method is post or put , which the params can not get from request.getParams() method #1652

Open
xirong opened this issue Aug 11, 2020 · 0 comments · May be fixed by #1653
Labels
area/dashboard Issues or PRs about Sentinel Dashboard

Comments

@xirong
Copy link

xirong commented Aug 11, 2020

Issue Description

thanks for #1042 contribute 👍 , which provide the @authaction to solve the privilege of method ; but when the http params path through http body , the com.alibaba.csp.sentinel.dashboard.auth.AuthorizationInterceptor current is not ok to check auth correctly.

Type: bug report

Describe what happened

I created my own AuthService , and extend auth mehod as my own demand , it works . 😄 but when the http method is post ,put , params path through http body , it not works . such an /v1/flow/rule , /paramFlow/rule and so on.

Describe what you expected to happen

check auth correctly .

How to reproduce it (as minimally and precisely as possible)

  1. change com.alibaba.csp.sentinel.dashboard.auth.SimpleWebAuthServiceImpl.SimpleWebAuthUserImpl#authTarget code
    . add the below code
         //target is the app name , this method to check the app has the PrivilegeType by your own demand.
        //when the target is null , return false to deny 
          if( null == target){
                return  false;
            }
  1. start or debug DashboardApplication ;
  2. find one resource and add a rule ; which method is /v1/flow/rule . the result is "Permission denied" .

Tell us your environment

jdk 1.8 ,the master branch , the release-1.7 branch is the same result .

Anything else we need to know?

none .

@sczyh30 sczyh30 added the area/dashboard Issues or PRs about Sentinel Dashboard label Aug 11, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/dashboard Issues or PRs about Sentinel Dashboard
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants