Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-12081

On 500page.jsp, only show services info to admins

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • High
    • 3.7.4
    • None
    • None

    Description

      If you go to http://jira.atlassian.com/500page.jsp, you'll see detailed config info for services and listeners, eg:

      • Sales Issue POP Service (com.atlassian.jira.service.services.pop.PopService)
      • Delay: 10 minutes
      • handler: Create Or Comment Handler
      • popserver: sales-issues @ atlassian.com
      • handler.params: project=SALES, issuetype=3
      • usessl: No SSL
      • forwardEmail: jeff@atlassian.com

      As great as this is for support, it does reveal potentially sensitive details like project keys to anonymous users. Also, if people develop custom services or listeners that are configured with passwords, those should show up here too.

      I think we should only display services/listeners data to people who are logged in as administrators.

      Attachments

        Issue Links

          Activity

            People

              sam@atlassian.com Sam Chang [Atlassian]
              7ee5c68a815f Jeff Turner
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: