Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Better plugin loading with security #23338

Closed
w33ble opened this issue Sep 19, 2018 · 1 comment
Closed

Better plugin loading with security #23338

w33ble opened this issue Sep 19, 2018 · 1 comment
Labels
bug Fixes for quality problems that affect the customer experience Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@w33ble
Copy link
Contributor

w33ble commented Sep 19, 2018

As noted in #23266, there's a problem loading plugins when security is enabled. #23334 fixed this by removing auth from the plugin loading route, but that can still leak the plugin code.

That plugin API endpoint shouldn't return anything unless the user is logged in. No redirects, but also no content.

This is probably blocked by the fix for #23303.
@w33ble w33ble added bug Fixes for quality problems that affect the customer experience Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas labels Sep 19, 2018
@alexfrancoeur alexfrancoeur added the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Oct 10, 2018
@cqliu1
Copy link
Contributor

cqliu1 commented Apr 30, 2019

Canvas no longer has a separate plugin build. Closing this issue.

@cqliu1 cqliu1 closed this as completed Apr 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Fixes for quality problems that affect the customer experience Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@w33ble @cqliu1 @alexfrancoeur