Skip to content
Snippets Groups Projects
Commit 994a5f79 authored by Daniel Gerhardt's avatar Daniel Gerhardt
Browse files

Merge branch '2.0' into 2.1

parents 3d58553f 988b3320
No related merge requests found
# Changelog
## 2.0.3
This release fixes a security vulnerability in the account management API. It is
highly recommended to upgrade if you are using database authentication.
Additional changes:
* Libraries have been upgraded to fix potential bugs
* Some unnecessary log warnings for Websocket communication are filtered
## 2.1
Major features:
* Public Pool (experimental): It is now possible to share sessions with other
......
......@@ -94,7 +94,7 @@ public class UserController extends AbstractController {
response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
}
@RequestMapping(value = { "/{username}" }, method = RequestMethod.DELETE)
@RequestMapping(value = { "/{username}/" }, method = RequestMethod.DELETE)
public final void activate(
@PathVariable final String username,
final HttpServletRequest request,
......
......@@ -425,7 +425,7 @@ public class UserService implements IUserService {
public DbUser deleteDbUser(String username) {
User user = getCurrentUser();
if (!user.getUsername().equals(username)
&& SecurityContextHolder.getContext().getAuthentication().getAuthorities()
&& !SecurityContextHolder.getContext().getAuthentication().getAuthorities()
.contains(new SimpleGrantedAuthority("ROLE_ADMIN"))) {
throw new UnauthorizedException();
}
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment