Upload routes inherit the Get operation's security, not Patch's
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 72/100
调研方向
Start with UploadableResourceMetadataCollectionFactory, where the upload route is built from the resource's Get operation. Inspect how security and securityPostDenormalize are assigned, and trace the resource's Patch/Put metadata instead. The change is complete when the generated upload operation inherits the write operation's security and the documented anonymous-upload reproduction is rejected.
由索引模型根据 Issue 内容生成。
描述
Problem
The bundle builds an uploadable resource's item upload route (POST {iri}/upload) from the resource's Get operation (UploadableResourceMetadataCollectionFactory), so the upload operation gets Get's security. A component with a public Get (the normal case: anyone can read published content) therefore has no operation-level security on uploads. Only the firewall's access_control (component writes admin-only in the template's security.yaml) stops a visitor from replacing a file.
Repro
- Add
#[Silverback\Uploadable]+ an#[UploadableField]to a component whose operations areGet(public) andPatch(security: "is_granted('ROLE_ADMIN')"). - Remove or loosen the
access_controlline for component writes. POST /_api/component/<type>/<id>/uploadas an anonymous user: the upload is accepted.
Fix used locally (Dons Hub)
Restrict Get to reads unless admin, so the derived upload operation is admin-only:
new Get(security: "request === null or request.getMethod() in ['GET', 'HEAD'] or is_granted('ROLE_ADMIN')"),
The proper fix would be for the factory to base the upload operation's security (and securityPostDenormalize) on the resource's Patch/Put operation instead of Get.
- 主要语言
- PHP
- 星标
- 32
- 派生
- 8
- 平均合并
- 1 小时 10 分钟
- 30 天内合并 PR
- 124
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
components-web-app/api-components-bundle 的其他 Issue
-
难度 5/5 一周以上 新手友好度 30/100
components-web-app/api-components-bundle#333 · 3 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 48/100
components-web-app/api-components-bundle#325 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 52/100
components-web-app/api-components-bundle#259 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 48/100
components-web-app/api-components-bundle#186 ·
维护者通常 1 天内回复
查看 components-web-app/api-components-bundle 的全部 Issue
相似的 Issue
-
jira-created
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 2 天内回复
-
enhancement
难度 1/5 1 小时以内 新手友好度 78/100
-
难度 2/5 1-3 小时 新手友好度 82/100
grokability/snipe-it#19996 ·
维护者通常 1 天内回复
-
enhancement
难度 1/5 1 小时以内 新手友好度 82/100
维护者通常 1 天内回复
-
Add a dark theme未关闭good first issue laravel-appointment-reminders
难度 2/5 1-3 小时 新手友好度 82/100