Actions
Bug #9747
closed
In 4.0.0, whole api is available under /secure/api, whatever the user role
Pull Request:
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
Fix check:
Regression:
Description
In 4.0.0, we added access to the API under /secure path so that user can use it to configure settings.
But we added the whole API tree, and that, whatever the role.
We need to limit to only admin role (read => get / write => other verbs) the access to only the settings API.
Updated by
Actions