{"action":"created","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/8942","repository_url":"https://api.github.com/repos/jhipster/generator-jhipster","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/8942/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/8942/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/8942/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/8942","id":389906668,"node_id":"MDU6SXNzdWUzODk5MDY2Njg=","number":8942,"title":"UAA will list all users to any registered user","user":{"login":"Brzhk","id":2929058,"node_id":"MDQ6VXNlcjI5MjkwNTg=","avatar_url":"https://avatars3.githubusercontent.com/u/2929058?v=4","gravatar_id":"","url":"https://api.github.com/users/Brzhk","html_url":"https://github.com/Brzhk","followers_url":"https://api.github.com/users/Brzhk/followers","following_url":"https://api.github.com/users/Brzhk/following{/other_user}","gists_url":"https://api.github.com/users/Brzhk/gists{/gist_id}","starred_url":"https://api.github.com/users/Brzhk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Brzhk/subscriptions","organizations_url":"https://api.github.com/users/Brzhk/orgs","repos_url":"https://api.github.com/users/Brzhk/repos","events_url":"https://api.github.com/users/Brzhk/events{/privacy}","received_events_url":"https://api.github.com/users/Brzhk/received_events","type":"User","site_admin":false},"labels":[{"id":580470884,"node_id":"MDU6TGFiZWw1ODA0NzA4ODQ=","url":"https://api.github.com/repos/jhipster/generator-jhipster/labels/uaa","name":"uaa","color":"92b1ef","default":false}],"state":"open","locked":false,"assignee":{"login":"xetys","id":2758003,"node_id":"MDQ6VXNlcjI3NTgwMDM=","avatar_url":"https://avatars1.githubusercontent.com/u/2758003?v=4","gravatar_id":"","url":"https://api.github.com/users/xetys","html_url":"https://github.com/xetys","followers_url":"https://api.github.com/users/xetys/followers","following_url":"https://api.github.com/users/xetys/following{/other_user}","gists_url":"https://api.github.com/users/xetys/gists{/gist_id}","starred_url":"https://api.github.com/users/xetys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xetys/subscriptions","organizations_url":"https://api.github.com/users/xetys/orgs","repos_url":"https://api.github.com/users/xetys/repos","events_url":"https://api.github.com/users/xetys/events{/privacy}","received_events_url":"https://api.github.com/users/xetys/received_events","type":"User","site_admin":false},"assignees":[{"login":"xetys","id":2758003,"node_id":"MDQ6VXNlcjI3NTgwMDM=","avatar_url":"https://avatars1.githubusercontent.com/u/2758003?v=4","gravatar_id":"","url":"https://api.github.com/users/xetys","html_url":"https://github.com/xetys","followers_url":"https://api.github.com/users/xetys/followers","following_url":"https://api.github.com/users/xetys/following{/other_user}","gists_url":"https://api.github.com/users/xetys/gists{/gist_id}","starred_url":"https://api.github.com/users/xetys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xetys/subscriptions","organizations_url":"https://api.github.com/users/xetys/orgs","repos_url":"https://api.github.com/users/xetys/repos","events_url":"https://api.github.com/users/xetys/events{/privacy}","received_events_url":"https://api.github.com/users/xetys/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2018-12-11T18:58:22Z","updated_at":"2019-01-01T19:09:38Z","closed_at":null,"author_association":"NONE","body":"##### **Overview of the issue**\r\n\r\nAnyone logged in with user's privileges can query /api/users and get the list of users.\r\n\r\n##### **Motivation for or Use Case**\r\n\r\nIt's not a personal bug to me. But it feels like a very dangerous default behavior.\r\n\r\n##### **Reproduce the error**\r\n\r\nset up an uaa-based project. \r\nlogin with user/user and get the token\r\nquery the uaa api\r\n???\r\nprofit\r\n\r\n##### **Related issues**\r\n\r\ni cant find one.\r\n\r\n##### **Suggest a Fix**\r\n\r\nannotate the UAA's UserResource's \"getAllUser\" method  (around line 145) to require admin role.\r\n\r\n##### **JHipster Version(s)**\r\n\r\n5.7.0\r\n\r\n##### **JHipster configuration**\r\n\r\n> INFO! Using JHipster version installed locally in current project's node_modules\r\n> INFO! Executing jhipster:info\r\n> INFO! Options: from-cli: true\r\n> Welcome to the JHipster Information Sub-Generator\r\n> \r\n> ##### **JHipster Version(s)**\r\n> \r\n> ```\r\n> uaa@0.0.0 /home/provisioner/rayon-salades/uaa\r\n> └── generator-jhipster@5.7.0 \r\n> \r\n> ```\r\n> \r\n> \r\n> ##### **JHipster configuration, a `.yo-rc.json` file generated in the root folder**\r\n> \r\n> \r\n> <details>\r\n> <summary>.yo-rc.json file</summary>\r\n> <pre>\r\n> {\r\n>   \"generator-jhipster\": {\r\n>     \"promptValues\": {\r\n>       \"packageName\": \"com.xxx.fr.salades\",\r\n>       \"nativeLanguage\": \"en\"\r\n>     },\r\n>     \"jhipsterVersion\": \"5.7.0\",\r\n>     \"applicationType\": \"uaa\",\r\n>     \"baseName\": \"uaa\",\r\n>     \"packageName\": \"com.xxx.fr.salades\",\r\n>     \"packageFolder\": \"com/xxx/fr/salades\",\r\n>     \"serverPort\": \"9999\",\r\n>     \"authenticationType\": \"uaa\",\r\n>     \"cacheProvider\": \"hazelcast\",\r\n>     \"enableHibernateCache\": true,\r\n>     \"websocket\": false,\r\n>     \"databaseType\": \"sql\",\r\n>     \"devDatabaseType\": \"h2Disk\",\r\n>     \"prodDatabaseType\": \"postgresql\",\r\n>     \"searchEngine\": false,\r\n>     \"messageBroker\": false,\r\n>     \"serviceDiscoveryType\": \"eureka\",\r\n>     \"buildTool\": \"gradle\",\r\n>     \"enableSwaggerCodegen\": false,\r\n>     \"jwtSecretKey\": \"bXktc2VjcmV0LXRva2VuLXRvLWNoYW5nZS1pbi1wcm9kdWN0aW9uLWFuZC10by1rZWVwLWluLWEtc2VjdXJlLXBsYWNl\",\r\n>     \"testFrameworks\": [\r\n>       \"gatling\",\r\n>       \"cucumber\"\r\n>     ],\r\n>     \"jhiPrefix\": \"jhi\",\r\n>     \"otherModules\": [],\r\n>     \"enableTranslation\": true,\r\n>     \"clientPackageManager\": \"npm\",\r\n>     \"nativeLanguage\": \"en\",\r\n>     \"languages\": [\r\n>       \"en\",\r\n>       \"ar-ly\",\r\n>       \"ca\",\r\n>       \"zh-cn\",\r\n>       \"zh-tw\",\r\n>       \"fr\",\r\n>       \"el\",\r\n>       \"hi\",\r\n>       \"id\",\r\n>       \"it\",\r\n>       \"pl\",\r\n>       \"pt-br\",\r\n>       \"pt-pt\",\r\n>       \"ro\",\r\n>       \"ru\",\r\n>       \"sk\",\r\n>       \"es\",\r\n>       \"tr\",\r\n>       \"ta\"\r\n>     ],\r\n>     \"skipClient\": true\r\n>   }\r\n> }\r\n> </pre>\r\n> </details>\r\n> \r\n> \r\n> ##### **JDL for the Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory**\r\n> \r\n> <details>\r\n> <summary>JDL entity definitions</summary>\r\n> \r\n> <pre>\r\n> \r\n> </pre>\r\n> </details>\r\n> \r\n> \r\n> ##### **Environment and Tools**\r\n> \r\n> openjdk version \"1.8.0_171\"\r\n> OpenJDK Runtime Environment (build 1.8.0_171-8u171-b11-0ubuntu0.17.10.1-b11)\r\n> OpenJDK 64-Bit Server VM (build 25.171-b11, mixed mode)\r\n> \r\n> git version 2.14.1\r\n> \r\n> node: v10.13.0\r\n> \r\n> npm: 6.4.1\r\n> \r\n> Docker version 18.06.1-ce, build e68fc7a\r\n> \r\n> docker-compose version 1.18.0, build 8dd22a9\r\n> \r\n> INFO! Congratulations, JHipster execution is complete!\r\n\r\n\r\n##### **Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory**\r\n\r\nN/A\r\n\r\n##### **Browsers and Operating System**\r\n\r\nN/A\r\n\r\n-   [x] Checking this box is mandatory (this is just to show you read everything)\r\n"},"comment":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/comments/450750700","html_url":"https://github.com/jhipster/generator-jhipster/issues/8942#issuecomment-450750700","issue_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/8942","id":450750700,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDc1MDcwMA==","user":{"login":"xetys","id":2758003,"node_id":"MDQ6VXNlcjI3NTgwMDM=","avatar_url":"https://avatars1.githubusercontent.com/u/2758003?v=4","gravatar_id":"","url":"https://api.github.com/users/xetys","html_url":"https://github.com/xetys","followers_url":"https://api.github.com/users/xetys/followers","following_url":"https://api.github.com/users/xetys/following{/other_user}","gists_url":"https://api.github.com/users/xetys/gists{/gist_id}","starred_url":"https://api.github.com/users/xetys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xetys/subscriptions","organizations_url":"https://api.github.com/users/xetys/orgs","repos_url":"https://api.github.com/users/xetys/repos","events_url":"https://api.github.com/users/xetys/events{/privacy}","received_events_url":"https://api.github.com/users/xetys/received_events","type":"User","site_admin":false},"created_at":"2019-01-01T19:09:38Z","updated_at":"2019-01-01T19:09:38Z","author_association":"MEMBER","body":"This must be a misunderstanding, as I was always doing this with uaa. In my demo project for the microXchg 2016 in Berlin I was demonstrating a one to one relationship with a 'Customer' entity to the user. \r\n\r\nCurrently I'm working on a private idea called songhub.io, which is built using version 5.7.1 were users are in a many to many relationship with an group entity. The only requirement is that entities related to the user must exist in the uaa. But it was working all the time since I have contributed it. More, it was one of the major intends for uaa, to make the user system compatible with other JHipster features.\r\n\r\nIn case of this, my PR will also break it for UAA and we need to skip this it find a solution."}}
{"actor":{"display_login":"xetys"}}