fix: add admin check for topic/node thombstone endpoint

nsqio · Oct 24, 2023 · fc75506 · fc75506
1 parent 51b270f
commit fc75506
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/nsqadmin/http.go b/nsqadmin/http.go
@@ -408,6 +408,10 @@ func (s *httpServer) nodeHandler(w http.ResponseWriter, req *http.Request, ps ht
 func (s *httpServer) tombstoneNodeForTopicHandler(w http.ResponseWriter, req *http.Request, ps httprouter.Params) (interface{}, error) {
  var messages []string
 
+ if !s.isAuthorizedAdminRequest(req) {
+ return nil, http_api.Err{403, "FORBIDDEN"}
+ }
+
  node := ps.ByName("node")
 
  var body struct {