Details
-
Bug
-
Status: Closed
-
Critical
-
Resolution: Duplicate
-
5.3.1
-
None
-
None
-
Linux, Solr Cloud
Description
I enabled security on my solr cloud and added basic authentication and authorization to allow only specific users to read and update the records. What I observed that update works fine but read does not stop from anonymous access.
On digging deeper I saw that RuleBasedAuthorizationPlugin.java has incorrectly defined the read permissions as follows:
read :
{" + " path:['/update/*', '/get']}," +
It should be /select/* rather than /update/*
Attachments
Issue Links
- duplicates
-
SOLR-8167 RuleBasedAuthorization plugin bypass with POST requests
- Resolved