0 Replies Latest reply on May 12, 2017 6:42 AM by Eugeney Putilin

    Downloading file by REST API as binary property dosen't use security

    Eugeney Putilin Newbie

      Hello All

       

      We are using REST service with custom AdvancedAuthorizationProvider. I found that if I upload some file by url http://localhost:8080/modeshape-rest/sample/default/upload/someurl/image.png

      The security works and call my AdvancedAuthorizationProvider when I try to get http://localhost:8080/modeshape-rest/sample/default/items/someurl/image.png or http://localhost:8080/modeshape-rest/sample/default/items/someurl/image.png/jcr:content

      Unfortunately, I don't see call of AdvancedAuthorizationProvider when I try to get content of file by execute http://localhost:8080/modeshape-rest/sample/default/binary/someurl/image.png/jcr:content/jcr:data

       

      I reviewed source of Modeshape 5.4.1 and found than the ModesShapes doesn't use security in getting any properties. In other worlds, If someone know URL anyone can get file without call my AdvancedAuthorizationProvider

       

      The question: this behavior expected  or this is backdoor? If this error should someone create Jira issue?

       

      Thanks.