Skip to content

Commit ad35c50

Browse files
author
Hayder Sharhan
committed
MAGETWO-50611: [Github][Security] WebAPIs allow anonymous access
- Changed the way di argument is structured. - Changed the acl node for some services. - Revised README
1 parent 737ba4b commit ad35c50

File tree

4 files changed

+39
-38
lines changed

4 files changed

+39
-38
lines changed

‎app/code/Magento/Catalog/etc/webapi.xml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,19 +97,19 @@
9797
<route url="/V1/products/types" method="GET">
9898
<service class="Magento\Catalog\Api\ProductTypeListInterface" method="getProductTypes"/>
9999
<resources>
100-
<resource ref="Magento_Catalog::attributes_attributes"/>
100+
<resource ref="Magento_Catalog::products"/>
101101
</resources>
102102
</route>
103103
<route url="/V1/products/attribute-sets/sets/list" method="GET">
104104
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="getList"/>
105105
<resources>
106-
<resource ref="Magento_Catalog::attributes_attributes"/>
106+
<resource ref="Magento_Catalog::sets"/>
107107
</resources>
108108
</route>
109109
<route url="/V1/products/attribute-sets/:attributeSetId" method="GET">
110110
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="get"/>
111111
<resources>
112-
<resource ref="Magento_Catalog::attributes_attributes"/>
112+
<resource ref="Magento_Catalog::sets"/>
113113
</resources>
114114
</route>
115115
<route url="/V1/products/attribute-sets/:attributeSetId" method="DELETE">
@@ -175,7 +175,7 @@
175175
<route url="/V1/products/attributes/:attributeCode/options" method="GET">
176176
<service class="Magento\Catalog\Api\ProductAttributeOptionManagementInterface" method="getItems"/>
177177
<resources>
178-
<resource ref="Magento_Catalog::sets" />
178+
<resource ref="Magento_Catalog::attributes_attributes" />
179179
</resources>
180180
</route>
181181
<route url="/V1/products/attributes/:attributeCode/options" method="POST">
@@ -199,7 +199,7 @@
199199
<route url="/V1/products/:sku/media/:entryId" method="GET">
200200
<service class="Magento\Catalog\Api\ProductAttributeMediaGalleryManagementInterface" method="get"/>
201201
<resources>
202-
<resource ref="Magento_Catalog::catalog"/>
202+
<resource ref="Magento_Catalog::attributes_attributes"/>
203203
</resources>
204204
</route>
205205
<route url="/V1/products/:sku/media" method="POST">

‎app/code/Magento/WebapiSecurity/Model/Plugin/AnonymousResourceSecurity.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ public function afterConvert(Converter $subject, $nodes)
5151
}
5252
$useInsecure = $this->config->getValue(self::XML_ALLOW_INSECURE);
5353
if ($useInsecure) {
54-
foreach ($this->resources as $route => $requestType) {
54+
foreach (array_keys($this->resources) as $resource) {
55+
list($route, $requestType) = explode("::", $resource);
5556
if ($result = $this->getNode($route, $requestType, $nodes["routes"])) {
5657
if (isset($result[$requestType]['resources'])) {
5758
$result[$requestType]['resources'] = ['anonymous' => true];

‎app/code/Magento/WebapiSecurity/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22

33
**WebapiSecurity** enables access management of some Web API resources.
44
If checkbox is enabled in backend through: Stores -> Configuration -> Services -> Magento Web API -> Web Api Security
5-
then the security of all of the services outlined in app/code/Magento/WebapiSecurity/etc/di.xml would be loosened. You may modify these services to customize.
5+
then the security of all of the services outlined in app/code/Magento/WebapiSecurity/etc/di.xml would be loosened. You may modify this list to customize which services should follow this behavior.
66
By loosening the security, these services would allow access anonymously (by anyone).

‎app/code/Magento/WebapiSecurity/etc/di.xml

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -16,37 +16,37 @@
1616
<type name="Magento\WebapiSecurity\Model\Plugin\AnonymousResourceSecurity">
1717
<arguments>
1818
<argument name="resources" xsi:type="array">
19-
<item name="/V1/products" xsi:type="string">GET</item>
20-
<item name="/V1/products/:sku" xsi:type="string">GET</item>
21-
<item name="/V1/products/attributes/:attributeCode" xsi:type="string">GET</item>
22-
<item name="/V1/products/types" xsi:type="string">GET</item>
23-
<item name="/V1/products/attribute-sets/sets/list" xsi:type="string">GET</item>
24-
<item name="/V1/products/attribute-sets/:attributeSetId" xsi:type="string">GET</item>
25-
<item name="/V1/products/attribute-sets/:attributeSetId/attributes" xsi:type="string">GET</item>
26-
<item name="/V1/products/attribute-sets/groups/list" xsi:type="string">GET</item>
27-
<item name="/V1/products/attributes/:attributeCode/options" xsi:type="string">GET</item>
28-
<item name="/V1/products/media/types/:attributeSetName" xsi:type="string">GET</item>
29-
<item name="/V1/products/:sku/media/:entryId" xsi:type="string">GET</item>
30-
<item name="/V1/products/:sku/media" xsi:type="string">GET</item>
31-
<item name="/V1/products/:sku/group-prices/:customerGroupId/tiers" xsi:type="string">GET</item>
32-
<item name="/V1/categories/:categoryId" xsi:type="string">GET</item>
33-
<item name="/V1/categories" xsi:type="string">GET</item>
34-
<item name="/V1/products/:sku/options" xsi:type="string">GET</item>
35-
<item name="/V1/products/:sku/options/:optionId" xsi:type="string">GET</item>
36-
<item name="/V1/products/links/types" xsi:type="string">GET</item>
37-
<item name="/V1/products/links/:type/attributes" xsi:type="string">GET</item>
38-
<item name="/V1/products/:sku/links/:type" xsi:type="string">GET</item>
39-
<item name="/V1/categories/:categoryId/products" xsi:type="string">GET</item>
40-
<item name="/V1/stockStatuses/:productSku" xsi:type="string">GET</item>
41-
<item name="/V1/configurable-products/:sku/children" xsi:type="string">GET</item>
42-
<item name="/V1/configurable-products/:sku/options/:id" xsi:type="string">GET</item>
43-
<item name="/V1/configurable-products/:sku/options/all" xsi:type="string">GET</item>
44-
<item name="/V1/cmsPage/:pageId" xsi:type="string">GET</item>
45-
<item name="/V1/cmsBlock/:blockId" xsi:type="string">GET</item>
46-
<item name="/V1/store/storeViews" xsi:type="string">GET</item>
47-
<item name="/V1/store/storeGroups" xsi:type="string">GET</item>
48-
<item name="/V1/store/websites" xsi:type="string">GET</item>
49-
<item name="/V1/store/storeConfigs" xsi:type="string">GET</item>
19+
<item name="/V1/products::GET" xsi:type="string"/>
20+
<item name="/V1/products/:sku::GET" xsi:type="string"/>
21+
<item name="/V1/products/attributes/:attributeCode::GET" xsi:type="string"/>
22+
<item name="/V1/products/types::GET" xsi:type="string"/>
23+
<item name="/V1/products/attribute-sets/sets/list::GET" xsi:type="string"/>
24+
<item name="/V1/products/attribute-sets/:attributeSetId::GET" xsi:type="string"/>
25+
<item name="/V1/products/attribute-sets/:attributeSetId/attributes::GET" xsi:type="string"/>
26+
<item name="/V1/products/attribute-sets/groups/list::GET" xsi:type="string"/>
27+
<item name="/V1/products/attributes/:attributeCode/options::GET" xsi:type="string"/>
28+
<item name="/V1/products/media/types/:attributeSetName::GET" xsi:type="string"/>
29+
<item name="/V1/products/:sku/media/:entryId::GET" xsi:type="string"/>
30+
<item name="/V1/products/:sku/media::GET" xsi:type="string"/>
31+
<item name="/V1/products/:sku/group-prices/:customerGroupId/tiers::GET" xsi:type="string"/>
32+
<item name="/V1/categories/:categoryId::GET" xsi:type="string"/>
33+
<item name="/V1/categories::GET" xsi:type="string"/>
34+
<item name="/V1/products/:sku/options::GET" xsi:type="string"/>
35+
<item name="/V1/products/:sku/options/:optionId::GET" xsi:type="string"/>
36+
<item name="/V1/products/links/types::GET" xsi:type="string"/>
37+
<item name="/V1/products/links/:type/attributes::GET" xsi:type="string"/>
38+
<item name="/V1/products/:sku/links/:type::GET" xsi:type="string"/>
39+
<item name="/V1/categories/:categoryId/products::GET" xsi:type="string"/>
40+
<item name="/V1/stockStatuses/:productSku::GET" xsi:type="string"/>
41+
<item name="/V1/configurable-products/:sku/children::GET" xsi:type="string"/>
42+
<item name="/V1/configurable-products/:sku/options/:id::GET" xsi:type="string"/>
43+
<item name="/V1/configurable-products/:sku/options/all::GET" xsi:type="string"/>
44+
<item name="/V1/cmsPage/:pageId::GET" xsi:type="string"/>
45+
<item name="/V1/cmsBlock/:blockId::GET" xsi:type="string"/>
46+
<item name="/V1/store/storeViews::GET" xsi:type="string"/>
47+
<item name="/V1/store/storeGroups::GET" xsi:type="string"/>
48+
<item name="/V1/store/websites::GET" xsi:type="string"/>
49+
<item name="/V1/store/storeConfigs::GET" xsi:type="string"/>
5050
</argument>
5151
</arguments>
5252
</type>

0 commit comments

Comments
 (0)