[#1360] Fix ConfigurationManagement#getState (#1467)

Fix access control: HAS_AUTH_READ_TARGET -> IS_CONTROLLER or HAS_AUTH_READ_TARGET (shall be accessibly by targets when confirmation base is requested) Signed-off-by: Marinov Avgustin <[email protected]>
eclipse-hawkbit · Nov 3, 2023 · 7b67de3 · 7b67de3
1 parent 68e7daa
commit 7b67de3
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...t-repository-api/src/main/java/org/eclipse/hawkbit/repository/ConfirmationManagement.java b/...t-repository-api/src/main/java/org/eclipse/hawkbit/repository/ConfirmationManagement.java
@@ -61,7 +61,8 @@ AutoConfirmationStatus activateAutoConfirmation(@NotEmpty String controllerId, f
      * @return instance of {@link AutoConfirmationStatus} wrapped in an
      *         {@link Optional}. Present if active and empty if disabled.
      */
-    @PreAuthorize(SpPermission.SpringEvalExpressions.HAS_AUTH_READ_TARGET)
+    @PreAuthorize(SpPermission.SpringEvalExpressions.IS_CONTROLLER + SpPermission.SpringEvalExpressions.HAS_AUTH_OR +
+            SpPermission.SpringEvalExpressions.HAS_AUTH_READ_TARGET)
     Optional<AutoConfirmationStatus> getStatus(@NotEmpty String controllerId);
 
     /**