[jboss-jira] [JBoss JIRA] Commented: (JBPORTAL-1841) URL hacking allows edit mode in weather portlet

[Prabhat Jha (JIRA)]

    [ http://jira.jboss.com/jira/browse/JBPORTAL-1841?page=comments#action_12391947 ] 
            
Prabhat Jha commented on JBPORTAL-1841:
---------------------------------------

Try this:
1. Start up Portal.
2. Access the weather portal page as it is and see Miami weather.
3. Now enter http://localhost:8080/portal/auth/portal/default/Weather/WeatherPortletWindow?windowstate=maximized?mode=edit  in browser's address directly and see what you get.

> URL hacking allows edit mode in weather portlet
> -----------------------------------------------
>
>                 Key: JBPORTAL-1841
>                 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1841
>             Project: JBoss Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Portal Core
>    Affects Versions: 2.6.3 Final
>            Reporter: Prabhat Jha
>         Assigned To: Thomas Heute
>            Priority: Critical
>
> If you are not logged in then weather portlet does not show edit icon which is good. But if I hack the URL to http://localhost:8080/portal/auth/portal/default/Weather/WeatherPortletWindow?windowstate=maximized?mode=edit, I am able to get into edit mode and change the zip code.  Is this how it supposed to be? 
> Sohil suggests:
> "no it shouldn't do that. Either the Edit Mode logic of the Portlet should protect against this (a bit painful design), or Portal's security layer should have the granularity to provide role-based protection of the "Edit Mode" of Portlets as a cross cutting aspect. I like the second option better personally"

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira