From 8157ac241ee29c24dac844c195edfeb3a1db95d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Mon, 2 Nov 2020 13:58:32 +0100 Subject: [PATCH] put back the role hole MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- accounts/pkg/service/v0/accounts.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/accounts/pkg/service/v0/accounts.go b/accounts/pkg/service/v0/accounts.go index 17ec6719d7..3e8fc06d24 100644 --- a/accounts/pkg/service/v0/accounts.go +++ b/accounts/pkg/service/v0/accounts.go @@ -65,7 +65,16 @@ func (s Service) hasAccountManagementPermissions(ctx context.Context) bool { // get roles from context roleIDs, ok := roles.ReadRoleIDsFromContext(ctx) if !ok { - return false + /** + * FIXME: with this we are skipping permission checks on all requests that are coming in without roleIDs in the + * metadata context. This is a huge security impairment, as that's the case not only for grpc requests but also + * for unauthenticated http requests and http requests coming in without hitting the ocis-proxy first. + */ + // TODO add system role for internal requests. + // - at least the proxy needs to look up account info + // - glauth needs to make bind requests + // tracked as OCIS-454 + return true } // check if permission is present in roles of the authenticated account