Add permission check for displaying content pack uninstall details (#…

…18177) (#18181) (cherry picked from commit c8adb0b) Co-authored-by: Othello Maurer <othello@graylog.com>
Graylog2 · Feb 6, 2024 · 2cb847c · 2cb847c
1 parent 7f8ef7f
commit 2cb847c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/changelog/unreleased/pr-18177.toml b/changelog/unreleased/pr-18177.toml
@@ -0,0 +1,4 @@
+type = "fixed"
+message = "Add permission check for displaying content pack uninstall details."
+
+pulls = ["18177"]
diff --git a/...er/src/main/java/org/graylog2/rest/resources/system/contentpacks/ContentPackResource.java b/...er/src/main/java/org/graylog2/rest/resources/system/contentpacks/ContentPackResource.java
@@ -331,6 +331,8 @@ public ContentPackUninstallDetails uninstallDetails(
             @PathParam("contentPackId") ModelId id,
             @ApiParam(name = "installationId", value = "Installation ID", required = true)
             @PathParam("installationId") String installationId) {
+        checkPermission(RestPermissions.CONTENT_PACK_READ, id.toString());
+
         final ContentPackInstallation installation = contentPackInstallationPersistenceService.findById(new ObjectId(installationId))
                 .orElseThrow(() -> new NotFoundException("Couldn't find installation " + installationId));