Skip to content

Commit bcf64cc

Browse files
author
Hayder Sharhan
committed
Merge remote-tracking branch 'remotes/api/MAGETWO-50611-Github-Security-WebAPIs-allow-anonymous-access' into bug-fixes
2 parents 0cd6b3a + 24d7969 commit bcf64cc

File tree

18 files changed

+395
-37
lines changed

18 files changed

+395
-37
lines changed

‎app/code/Magento/Catalog/etc/webapi.xml

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@
3030
<route url="/V1/products" method="GET">
3131
<service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
3232
<resources>
33-
<resource ref="anonymous" />
33+
<resource ref="Magento_Catalog::products" />
3434
</resources>
3535
</route>
3636
<route url="/V1/products/:sku" method="GET">
3737
<service class="Magento\Catalog\Api\ProductRepositoryInterface" method="get"/>
3838
<resources>
39-
<resource ref="anonymous" />
39+
<resource ref="Magento_Catalog::products" />
4040
</resources>
4141
</route>
4242

@@ -49,7 +49,7 @@
4949
<route url="/V1/products/attributes/:attributeCode" method="GET">
5050
<service class="Magento\Catalog\Api\ProductAttributeRepositoryInterface" method="get"/>
5151
<resources>
52-
<resource ref="anonymous" />
52+
<resource ref="Magento_Catalog::attributes_attributes" />
5353
</resources>
5454
</route>
5555
<route url="/V1/products/attributes" method="GET">
@@ -97,19 +97,19 @@
9797
<route url="/V1/products/types" method="GET">
9898
<service class="Magento\Catalog\Api\ProductTypeListInterface" method="getProductTypes"/>
9999
<resources>
100-
<resource ref="anonymous"/>
100+
<resource ref="Magento_Catalog::attributes_attributes"/>
101101
</resources>
102102
</route>
103103
<route url="/V1/products/attribute-sets/sets/list" method="GET">
104104
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="getList"/>
105105
<resources>
106-
<resource ref="anonymous"/>
106+
<resource ref="Magento_Catalog::attributes_attributes"/>
107107
</resources>
108108
</route>
109109
<route url="/V1/products/attribute-sets/:attributeSetId" method="GET">
110110
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="get"/>
111111
<resources>
112-
<resource ref="anonymous"/>
112+
<resource ref="Magento_Catalog::attributes_attributes"/>
113113
</resources>
114114
</route>
115115
<route url="/V1/products/attribute-sets/:attributeSetId" method="DELETE">
@@ -133,7 +133,7 @@
133133
<route url="/V1/products/attribute-sets/:attributeSetId/attributes" method="GET">
134134
<service class="Magento\Catalog\Api\ProductAttributeManagementInterface" method="getAttributes"/>
135135
<resources>
136-
<resource ref="anonymous"/>
136+
<resource ref="Magento_Catalog::sets"/>
137137
</resources>
138138
</route>
139139
<route url="/V1/products/attribute-sets/attributes" method="POST">
@@ -151,7 +151,7 @@
151151
<route url="/V1/products/attribute-sets/groups/list" method="GET">
152152
<service class="Magento\Catalog\Api\ProductAttributeGroupRepositoryInterface" method="getList"/>
153153
<resources>
154-
<resource ref="anonymous"/>
154+
<resource ref="Magento_Catalog::sets"/>
155155
</resources>
156156
</route>
157157
<route url="/V1/products/attribute-sets/groups" method="POST">
@@ -175,7 +175,7 @@
175175
<route url="/V1/products/attributes/:attributeCode/options" method="GET">
176176
<service class="Magento\Catalog\Api\ProductAttributeOptionManagementInterface" method="getItems"/>
177177
<resources>
178-
<resource ref="anonymous" />
178+
<resource ref="Magento_Catalog::sets" />
179179
</resources>
180180
</route>
181181
<route url="/V1/products/attributes/:attributeCode/options" method="POST">
@@ -193,13 +193,13 @@
193193
<route url="/V1/products/media/types/:attributeSetName" method="GET">
194194
<service class="Magento\Catalog\Api\ProductMediaAttributeManagementInterface" method="getList"/>
195195
<resources>
196-
<resource ref="anonymous"/>
196+
<resource ref="Magento_Catalog::attributes_attributes"/>
197197
</resources>
198198
</route>
199199
<route url="/V1/products/:sku/media/:entryId" method="GET">
200200
<service class="Magento\Catalog\Api\ProductAttributeMediaGalleryManagementInterface" method="get"/>
201201
<resources>
202-
<resource ref="anonymous"/>
202+
<resource ref="Magento_Catalog::catalog"/>
203203
</resources>
204204
</route>
205205
<route url="/V1/products/:sku/media" method="POST">
@@ -223,15 +223,15 @@
223223
<route url="/V1/products/:sku/media" method="GET">
224224
<service class="Magento\Catalog\Api\ProductAttributeMediaGalleryManagementInterface" method="getList"/>
225225
<resources>
226-
<resource ref="anonymous"/>
226+
<resource ref="Magento_Catalog::catalog"/>
227227
</resources>
228228
</route>
229229

230230
<!-- Tier Price -->
231231
<route url="/V1/products/:sku/group-prices/:customerGroupId/tiers" method="GET">
232232
<service class="Magento\Catalog\Api\ProductTierPriceManagementInterface" method="getList"/>
233233
<resources>
234-
<resource ref="anonymous"/>
234+
<resource ref="Magento_Catalog::catalog"/>
235235
</resources>
236236
</route>
237237
<route url="/V1/products/:sku/group-prices/:customerGroupId/tiers/:qty/price/:price" method="POST">
@@ -256,7 +256,7 @@
256256
<route url="/V1/categories/:categoryId" method="GET">
257257
<service class="Magento\Catalog\Api\CategoryRepositoryInterface" method="get" />
258258
<resources>
259-
<resource ref="anonymous" />
259+
<resource ref="Magento_Catalog::categories" />
260260
</resources>
261261
</route>
262262
<route url="/V1/categories" method="POST">
@@ -268,7 +268,7 @@
268268
<route url="/V1/categories" method="GET">
269269
<service class="Magento\Catalog\Api\CategoryManagementInterface" method="getTree" />
270270
<resources>
271-
<resource ref="anonymous" />
271+
<resource ref="Magento_Catalog::categories" />
272272
</resources>
273273
</route>
274274
<route url="/V1/categories/:id" method="PUT">
@@ -294,13 +294,13 @@
294294
<route url="/V1/products/:sku/options" method="GET">
295295
<service class="Magento\Catalog\Api\ProductCustomOptionRepositoryInterface" method="getList"/>
296296
<resources>
297-
<resource ref="anonymous"/>
297+
<resource ref="Magento_Catalog::catalog"/>
298298
</resources>
299299
</route>
300300
<route url="/V1/products/:sku/options/:optionId" method="GET">
301301
<service class="Magento\Catalog\Api\ProductCustomOptionRepositoryInterface" method="get"/>
302302
<resources>
303-
<resource ref="anonymous"/>
303+
<resource ref="Magento_Catalog::catalog"/>
304304
</resources>
305305
</route>
306306
<route url="/V1/products/options" method="POST">
@@ -326,19 +326,19 @@
326326
<route url="/V1/products/links/types" method="GET">
327327
<service class="Magento\Catalog\Api\ProductLinkTypeListInterface" method="getItems"/>
328328
<resources>
329-
<resource ref="anonymous"/>
329+
<resource ref="Magento_Catalog::catalog"/>
330330
</resources>
331331
</route>
332332
<route url="/V1/products/links/:type/attributes" method="GET">
333333
<service class="Magento\Catalog\Api\ProductLinkTypeListInterface" method="getItemAttributes"/>
334334
<resources>
335-
<resource ref="anonymous"/>
335+
<resource ref="Magento_Catalog::catalog"/>
336336
</resources>
337337
</route>
338338
<route url="/V1/products/:sku/links/:type" method="GET">
339339
<service class="Magento\Catalog\Api\ProductLinkManagementInterface" method="getLinkedItemsByType"/>
340340
<resources>
341-
<resource ref="anonymous"/>
341+
<resource ref="Magento_Catalog::catalog"/>
342342
</resources>
343343
</route>
344344
<route url="/V1/products/:sku/links" method="POST">
@@ -364,7 +364,7 @@
364364
<route url="/V1/categories/:categoryId/products" method="GET">
365365
<service class="Magento\Catalog\Api\CategoryLinkManagementInterface" method="getAssignedProducts" />
366366
<resources>
367-
<resource ref="anonymous" />
367+
<resource ref="Magento_Catalog::categories" />
368368
</resources>
369369
</route>
370370
<route url="/V1/categories/:categoryId/products" method="POST">

‎app/code/Magento/CatalogInventory/etc/webapi.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<route url="/V1/stockStatuses/:productSku" method="GET">
2929
<service class="Magento\CatalogInventory\Api\StockRegistryInterface" method="getStockStatusBySku"/>
3030
<resources>
31-
<resource ref="anonymous"/>
31+
<resource ref="Magento_CatalogInventory::cataloginventory"/>
3232
</resources>
3333
</route>
3434
</routes>

‎app/code/Magento/Cms/etc/webapi.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
<route url="/V1/cmsPage/:pageId" method="GET">
1212
<service class="Magento\Cms\Api\PageRepositoryInterface" method="getById"/>
1313
<resources>
14-
<resource ref="anonymous"/>
14+
<resource ref="Magento_Cms::page"/>
1515
</resources>
1616
</route>
1717
<route url="/V1/cmsPage/search" method="GET">
@@ -42,7 +42,7 @@
4242
<route url="/V1/cmsBlock/:blockId" method="GET">
4343
<service class="Magento\Cms\Api\BlockRepositoryInterface" method="getById"/>
4444
<resources>
45-
<resource ref="anonymous"/>
45+
<resource ref="Magento_Cms::block"/>
4646
</resources>
4747
</route>
4848
<route url="/V1/cmsBlock/search" method="GET">

‎app/code/Magento/ConfigurableProduct/etc/webapi.xml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<route url="/V1/configurable-products/:sku/children" method="GET">
1111
<service class="Magento\ConfigurableProduct\Api\LinkManagementInterface" method="getChildren"/>
1212
<resources>
13-
<resource ref="anonymous"/>
13+
<resource ref="Magento_Catalog::products"/>
1414
</resources>
1515
</route>
1616
<route url="/V1/configurable-products/:sku/children/:childSku" method="DELETE">
@@ -34,13 +34,13 @@
3434
<route url="/V1/configurable-products/:sku/options/:id" method="GET">
3535
<service class="Magento\ConfigurableProduct\Api\OptionRepositoryInterface" method="get"/>
3636
<resources>
37-
<resource ref="anonymous"/>
37+
<resource ref="Magento_Catalog::products"/>
3838
</resources>
3939
</route>
4040
<route url="/V1/configurable-products/:sku/options/all" method="GET">
4141
<service class="Magento\ConfigurableProduct\Api\OptionRepositoryInterface" method="getList"/>
4242
<resources>
43-
<resource ref="anonymous"/>
43+
<resource ref="Magento_Catalog::products"/>
4444
</resources>
4545
</route>
4646
<route url="/V1/configurable-products/:sku/options" method="POST">

‎app/code/Magento/Store/etc/webapi.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,31 +11,31 @@
1111
<route url="/V1/store/storeViews" method="GET">
1212
<service class="Magento\Store\Api\StoreRepositoryInterface" method="getList"/>
1313
<resources>
14-
<resource ref="anonymous"/>
14+
<resource ref="Magento_Backend::store"/>
1515
</resources>
1616
</route>
1717

1818
<!-- Store Groups-->
1919
<route url="/V1/store/storeGroups" method="GET">
2020
<service class="Magento\Store\Api\GroupRepositoryInterface" method="getList"/>
2121
<resources>
22-
<resource ref="anonymous"/>
22+
<resource ref="Magento_Backend::store"/>
2323
</resources>
2424
</route>
2525

2626
<!-- Website -->
2727
<route url="/V1/store/websites" method="GET">
2828
<service class="Magento\Store\Api\WebsiteRepositoryInterface" method="getList"/>
2929
<resources>
30-
<resource ref="anonymous"/>
30+
<resource ref="Magento_Backend::store"/>
3131
</resources>
3232
</route>
3333

3434
<!-- Store Config -->
3535
<route url="/V1/store/storeConfigs" method="GET">
3636
<service class="Magento\Store\Api\StoreConfigManagerInterface" method="getStoreConfigs"/>
3737
<resources>
38-
<resource ref="anonymous"/>
38+
<resource ref="Magento_Backend::store"/>
3939
</resources>
4040
</route>
4141
</routes>

0 commit comments

Comments
 (0)