Status/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Aaron Neff / Aaron Neff (Aaron Neff)
Created: 01/23/2015
Components: Security
Versions: 11.0
Failure Type:
Found In Build/Fixed In Build: CF11_Final / CF11 Update7
Priority/Frequency: Major / Some users will encounter
Locale/System: ALL / Platforms All
Vote Count: 1
<cfloginuser> breaks Admin API access
Repro steps:
1) Run this:
<cflogout>
<cflogin>
<cfloginuser name="foo" password="bar" roles="foobar">
</cflogin>
<cfscript>
function myFunction() {
adminAPI = new CFIDE.adminapi.administrator();
loginResult = adminAPI.login(thePassword, theUsername);
writeOutput(loginResult);
try {
obj = new CFIDE.adminapi.servermonitoring();
activeRequests = obj.getAllActiveRequests();
writeOutput("success!");
}
catch(any e) {
writeOutput(e.message);
}
}
myFunction();
</cfscript>
<cflogout><br>
<cfset myFunction()>
Expected result:
true success!
true success!
Actual result:
true The current user is not authorized to invoke this method.
true success!
- If user is not logged-in via <cflogin> framework, then Admin API calls succeed.
- If user is logged-in via <cflogin> framework, then Admin API calls fail.
<cfloginuser> should not be breaking Admin API access.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 3926238
External Customer Info:
External Company:
External Customer Name: Aaron
External Customer Email:Attachments:
Comments: