fix: add admin check for topic/node thombstone endpoint

nsqio · Sep 28, 2023 · 5379bf4 · 5379bf4
1 parent 51b270f
commit 5379bf4
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/nsqadmin/http.go b/nsqadmin/http.go
@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/julienschmidt/httprouter"
+
 	"github.com/nsqio/nsq/internal/clusterinfo"
 	"github.com/nsqio/nsq/internal/http_api"
 	"github.com/nsqio/nsq/internal/lg"
@@ -408,6 +409,10 @@ func (s *httpServer) nodeHandler(w http.ResponseWriter, req *http.Request, ps ht
 func (s *httpServer) tombstoneNodeForTopicHandler(w http.ResponseWriter, req *http.Request, ps httprouter.Params) (interface{}, error) {
 	var messages []string
 
+	if !s.isAuthorizedAdminRequest(req) {
+		return nil, http_api.Err{403, "FORBIDDEN"}
+	}
+
 	node := ps.ByName("node")
 
 	var body struct {