[
https://issues.jboss.org/browse/AS7-465?page=com.atlassian.jira.plugin.sy...
]
Brian Stansberry commented on AS7-465:
--------------------------------------
A simple way to enforce this is via the OperationContext. It can validate any calls to
readResourceForUpdate/readModelForUpdate/createResource/addResource/removeResource. The
descriptions are more problematic.
In domain mode, prevent end-user access to and visibility of most
configuration write operations
------------------------------------------------------------------------------------------------
Key: AS7-465
URL:
https://issues.jboss.org/browse/AS7-465
Project: Application Server 7
Issue Type: Task
Components: Domain Management
Reporter: Brian Stansberry
Assignee: Brian Stansberry
Priority: Blocker
Fix For: 7.1.0.Final
In domain mode most (almost certainly all) server level operations that update the
persistent configuration should not be directly accessible by the end user and should not
appear in the results of the read-resource-description, read-operation-names or
read-operation-description operations if executed against a server-level resource. They
can only be invoked by the host controller that is responsible for the server.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see:
http://www.atlassian.com/software/jira