Skip to content

Commit 24d7969

Browse files
author
Hayder Sharhan
committed
MAGETWO-50611: [Github][Security] WebAPIs allow anonymous access
- Revised README - Added config file to define default value of checkbox. - Changed location of checkbox in backend. - Changed text of label.
1 parent a19a8d9 commit 24d7969

File tree

8 files changed

+68
-34
lines changed

8 files changed

+68
-34
lines changed

‎app/code/Magento/Store/etc/webapi.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,31 +11,31 @@
1111
<route url="/V1/store/storeViews" method="GET">
1212
<service class="Magento\Store\Api\StoreRepositoryInterface" method="getList"/>
1313
<resources>
14-
<resource ref="Magento_Backend::admin"/>
14+
<resource ref="Magento_Backend::store"/>
1515
</resources>
1616
</route>
1717

1818
<!-- Store Groups-->
1919
<route url="/V1/store/storeGroups" method="GET">
2020
<service class="Magento\Store\Api\GroupRepositoryInterface" method="getList"/>
2121
<resources>
22-
<resource ref="Magento_Backend::admin"/>
22+
<resource ref="Magento_Backend::store"/>
2323
</resources>
2424
</route>
2525

2626
<!-- Website -->
2727
<route url="/V1/store/websites" method="GET">
2828
<service class="Magento\Store\Api\WebsiteRepositoryInterface" method="getList"/>
2929
<resources>
30-
<resource ref="Magento_Backend::admin"/>
30+
<resource ref="Magento_Backend::store"/>
3131
</resources>
3232
</route>
3333

3434
<!-- Store Config -->
3535
<route url="/V1/store/storeConfigs" method="GET">
3636
<service class="Magento\Store\Api\StoreConfigManagerInterface" method="getStoreConfigs"/>
3737
<resources>
38-
<resource ref="Magento_Backend::admin"/>
38+
<resource ref="Magento_Backend::store"/>
3939
</resources>
4040
</route>
4141
</routes>

‎app/code/Magento/WebapiSecurity/Model/Plugin/AnonymousResourceSecurity.php

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,38 +9,41 @@
99

1010
class AnonymousResourceSecurity
1111
{
12-
const XML_ALLOW_INSECURE = 'system/webapisecurity/allow_insecure';
12+
const XML_ALLOW_INSECURE = 'webapi/webapisecurity/allow_insecure';
1313

1414
/**
15-
* @var \Magento\Backend\App\ConfigInterface
15+
* @var \Magento\Framework\App\Config\ReinitableConfigInterface
1616
*/
17-
protected $backendConfig;
17+
protected $config;
1818

1919
/**
20-
* @var string
20+
* @var array
2121
*/
2222
protected $resources;
2323

2424
/**
2525
* AnonymousResourceSecurity constructor.
2626
*
27-
* @param \Magento\Backend\App\ConfigInterface $backendConfig
28-
* @param $resources
27+
* @param \Magento\Framework\App\Config\ReinitableConfigInterface $config
28+
* @param array $resources
2929
*/
30-
public function __construct(\Magento\Backend\App\ConfigInterface $backendConfig, $resources)
30+
public function __construct(\Magento\Framework\App\Config\ReinitableConfigInterface $config, $resources)
3131
{
32-
$this->backendConfig = $backendConfig;
32+
$this->config = $config;
3333
$this->resources = $resources;
3434
}
3535

36-
public function afterConvert(
37-
Converter $subject,
38-
$nodes
39-
) {
36+
/**
37+
* @param Converter $subject
38+
* @param array $nodes
39+
* @return array
40+
*/
41+
public function afterConvert(Converter $subject, $nodes)
42+
{
4043
if (empty($nodes)) {
4144
return $nodes;
4245
}
43-
$useInsecure = $this->backendConfig->isSetFlag(self::XML_ALLOW_INSECURE);
46+
$useInsecure = $this->config->getValue(self::XML_ALLOW_INSECURE);
4447
if ($useInsecure) {
4548
foreach ($this->resources as $route => $requestType) {
4649
if ($result = $this->getNode($route, $requestType, $nodes["routes"])) {
@@ -63,6 +66,12 @@ public function afterConvert(
6366
return $nodes;
6467
}
6568

69+
/**
70+
* @param string $route
71+
* @param string $requestType
72+
* @param array $source
73+
* @return array|null
74+
*/
6675
private function getNode($route, $requestType, $source)
6776
{
6877
if (isset($source[$route][$requestType])) {

‎app/code/Magento/WebapiSecurity/Model/Plugin/CacheInvalidator.php

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,19 @@ public function __construct(\Magento\Framework\App\Cache\TypeListInterface $cach
2222
$this->cacheTypeList = $cacheTypeList;
2323
}
2424

25+
/**
26+
* @param \Magento\Framework\App\Config\Value $subject
27+
* @param \Magento\Framework\App\Config\Value $result
28+
*
29+
* @return \Magento\Framework\App\Config\Value
30+
*/
2531
public function afterAfterSave(
2632
\Magento\Framework\App\Config\Value $subject,
27-
$result
28-
)
29-
{
30-
if ($result->getPath() == "system/webapisecurity/allow_insecure" && $result->isValueChanged()) {
33+
\Magento\Framework\App\Config\Value $result
34+
) {
35+
if ($result->getPath() == \Magento\WebapiSecurity\Model\Plugin\AnonymousResourceSecurity::XML_ALLOW_INSECURE
36+
&& $result->isValueChanged()
37+
) {
3138
$this->cacheTypeList->invalidate(\Magento\Webapi\Model\Cache\Type\Webapi::TYPE_IDENTIFIER);
3239
}
3340

‎app/code/Magento/WebapiSecurity/README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# WebapiSecurity
22

3-
**WebapiSecurity** enables access management of some webapi resources.
4-
Allowing them to be accessed by anyone. These resources are outlined in di.xml
5-
If anonymous access checkbox is enabled in backend, these resources' security is loosened.
3+
**WebapiSecurity** enables access management of some Web API resources.
4+
If checkbox is enabled in backend through: Stores -> Configuration -> Services -> Magento Web API -> Web Api Security
5+
then the security of all of the services outlined in app/code/Magento/WebapiSecurity/etc/di.xml would be loosened. You may modify these services to customize.
6+
By loosening the security, these services would allow access anonymously (by anyone).

‎app/code/Magento/WebapiSecurity/etc/Adminhtml/system.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
-->
66
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
77
<system>
8-
<section id="system">
8+
<section id="webapi" translate="label" type="text" sortOrder="102" showInDefault="1" showInWebsite="1" showInStore="1">
99
<group id="webapisecurity" translate="label" type="text" sortOrder="250" showInDefault="1" showInWebsite="0" showInStore="0">
10-
<label>Webapi Security</label>
10+
<label>Web API Security</label>
1111
<field id="allow_insecure" translate="label" type="select" sortOrder="1" showInDefault="1" showInWebsite="0" showInStore="0">
12-
<label>Allow insecure anonymous access for some CMS, Catalog and Store services</label>
12+
<label>Allow insecure anonymous access</label>
1313
<source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
14-
<comment>Full list can be viewed at Magento/app/code/Magento/WebapiSecurity/etc/di.xml</comment>
14+
<comment>Anonymous access would be provided for some CMS, Catalog and Store services</comment>
1515
</field>
1616
</group>
1717
</section>

‎app/code/Magento/WebapiSecurity/etc/config.xml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0"?>
2+
<!--
3+
/**
4+
* Copyright © 2016 Magento. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
9+
<default>
10+
<webapi>
11+
<webapisecurity>
12+
<allow_insecure>0</allow_insecure>
13+
</webapisecurity>
14+
</webapi>
15+
</default>
16+
</config>

‎composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@
172172
"magento/module-vault": "100.0.2",
173173
"magento/module-version": "100.0.2",
174174
"magento/module-webapi": "100.0.2",
175+
"magento/module-webapisecurity": "100.0.2",
175176
"magento/module-weee": "100.0.2",
176177
"magento/module-widget": "100.0.2",
177178
"magento/module-wishlist": "100.0.2",

‎composer.lock

Lines changed: 6 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)