Potential incorrect WPS-1 service ACL permissions validation #157
Labels
bug
Problem, error, or invalid behaviour
investigate
Issue or new component that needs further exploration
security
New security features or failing AuthN/AuthZ conditions
see crim-ca/weaver#22 for use case
POST
for WPS-1request=Execute
doesn't cause problem (when using XML body instead ofDataInputs=...
in URI withGET
request). When request has XML body, the values inside it are used instead ofidentifier=...&request=...
in the URI. Therefore, theServiceWPS
possibly fails to retrieve the actualrequest
field, and then fails to retrieve the proper ACL for Twitcher.request=...
to corresponding Magpie service permission mapping is properly accomplished so that access to corresponding requests is granted/blocked as expected.The text was updated successfully, but these errors were encountered: