GatherQueue: Require PRIV_CONTROL_GATHERER for Delete/Retry all button

These functions were inadvertently available to all users.
nla · Jul 3, 2024 · 05b3554 · 05b3554
1 parent 2ae40f8
commit 05b3554
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/ui/resources/templates/gather/GatherQueue.html b/ui/resources/templates/gather/GatherQueue.html
@@ -137,10 +137,10 @@ <h2 id="queued">Scheduled for today</h2>
 
  <section>
  <h2>Failed</h2>
- <form th:action="@{/queue/retry-all}" method="post">
+ <form sec:authorize="hasAuthority('PRIV_CONTROL_GATHERER')" th:action="@{/queue/retry-all}" method="post">
  <button type="submit" class="btn-danger">Retry all</button>
  </form>
- <form th:action="@{/queue/delete-all-failed}" method="post">
+ <form sec:authorize="hasAuthority('PRIV_CONTROL_GATHERER')" th:action="@{/queue/delete-all-failed}" method="post">
  <button type="submit" class="btn-danger">Delete all</button>
  </form>
 

diff --git a/ui/src/pandas/gather/GatherQueueController.java b/ui/src/pandas/gather/GatherQueueController.java
@@ -62,13 +62,15 @@ public String unpauseGathers() {
  }
 
  @PostMapping("/queue/retry")
+ @PreAuthorize("hasAuthority('PRIV_CONTROL_GATHERER')")
  @Transactional
  public String retry(@RequestParam("instance") Instance instance) {
  instanceService.retryAfterFailure(instance, userService.getCurrentUser());
  return "redirect:/queue";
  }
 
  @PostMapping("/queue/retry-all")
+ @PreAuthorize("hasAuthority('PRIV_CONTROL_GATHERER')")
  @Transactional
  public String retryAll() {
  for (Instance instance : listFailedInstances()) {