Project

General

Profile

Actions

Bug #26973

open

Rollback event log endpoint has the wrong HTTP method

Added by Clark ANDRIANASOLO 1 day ago. Updated about 5 hours ago.

Status:
Pending release
Priority:
N/A
Category:
Security
Target version:
Severity:
Trivial - no functional impact | cosmetic
UX impact:
User visibility:
Effort required:
Very Small
Priority:
0
Name check:
To do
Fix check:
Checked
Regression:
No

Description

The internal endpoint has a GET method for a modification, it should be POST instead


Files

clipboard-202505281747-1sqi4.png (234 KB) clipboard-202505281747-1sqi4.png Clark ANDRIANASOLO, 2025-05-28 17:47

Subtasks 1 (1 open0 closed)

Bug #26981: Rollback endpoint in event logs need updated API yaml tests Pending releaseFrançois ARMANDActions
Actions #1

Updated by Clark ANDRIANASOLO 1 day ago

  • Status changed from New to In progress
Actions #2

Updated by Clark ANDRIANASOLO 1 day ago

  • Status changed from In progress to Pending technical review
  • Pull Request set to https://github.com/Normation/rudder/pull/6401
Actions #3

Updated by Clark ANDRIANASOLO 1 day ago

  • Status changed from Pending technical review to Pending release
Actions #4

Updated by Clark ANDRIANASOLO 1 day ago

  • Subtask #26979 added
Actions #5

Updated by Clark ANDRIANASOLO 1 day ago

  • Subtask #26981 added
Actions #6

Updated by Clark ANDRIANASOLO about 5 hours ago

It is now with POST method :

For the authz definition, the previous user with admin read can not rollback an event log :

2025-05-28 17:54:48+0200 WARN  api-processing - User 'adminread' is not authorized to access API 'eventFilterDetails
2025-05-28 17:54:48+0200 INFO  api-processing.response-error - "User 'adminread' is not authorized to access API 'eventFilterDetails" 

Actions #7

Updated by Clark ANDRIANASOLO about 5 hours ago

  • Fix check changed from To do to Checked
Actions

Also available in: Atom PDF