|
|
@@ -53,6 +53,8 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
.addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
|
|
|
|
|
|
.authorizeRequests()
|
|
|
+ // 为保证风格一致，以及保证鉴权完备，拒绝所有以 / 结尾的请求，只有无 / 结尾的请求才可被访问
|
|
|
+ .antMatchers("/**/").denyAll()
|
|
|
// API Test Controller
|
|
|
.antMatchers(HttpMethod.GET, "/test/list/{projectId}").access("@authTools.checkProjOwnership(#projectId)")
|
|
|
.antMatchers(HttpMethod.GET, "/test/delete/{testId}").access("@authTools.checkTestOwnership(#testId)")
|
|
|
@@ -83,7 +85,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
// Commit Controller
|
|
|
.antMatchers(HttpMethod.GET, "/commits/tree").access("@authTools.checkTreeNodeOwnershipParam(request)")
|
|
|
.antMatchers(HttpMethod.GET, "/commits/bug_list").access("@authTools.checkBugOwnershipParam(request)")
|
|
|
- .antMatchers(HttpMethod.GET, "/commits/list").access("@authTools.checkProjOwnershipParam(reuqest)")
|
|
|
+ .antMatchers(HttpMethod.GET, "/commits/list").access("@authTools.checkProjOwnershipParam(request)")
|
|
|
// Deployment Controller
|
|
|
.antMatchers(HttpMethod.GET, "/deployments/list").access("@authTools.checkProjOwnershipParam(request)")
|
|
|
.antMatchers(HttpMethod.GET, "/deployments/log").access("@authTools.checkProjPipelineParam(request)")
|
