TRUNK-6203: Global properties access should be privileged

openmrs · Jul 8, 2024 · 28fc5a7 · 28fc5a7
1 parent ff12904
commit 28fc5a7
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/omod/src/main/java/org/openmrs/module/uiframework/PageController.java b/omod/src/main/java/org/openmrs/module/uiframework/PageController.java
@@ -16,6 +16,7 @@
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang.StringUtils;
 import org.openmrs.api.APIAuthenticationException;
+import org.openmrs.api.context.Context;
 import org.openmrs.ui.framework.UiFrameworkException;
 import org.openmrs.ui.framework.WebConstants;
 import org.openmrs.ui.framework.page.FileDownload;
@@ -26,6 +27,7 @@
 import org.openmrs.ui.framework.session.Session;
 import org.openmrs.ui.framework.session.SessionFactory;
 import org.openmrs.ui.util.ExceptionUtil;
+import org.openmrs.util.PrivilegeConstants;
 import org.owasp.encoder.Encode;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -117,6 +119,7 @@ public String handlePath(String path, HttpServletRequest request, HttpServletRes
 		}
 		PageRequest pageRequest = new PageRequest(providerName, pageName, request, response, session);
 		try {
+			Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
 			String html = pageFactory.handle(pageRequest);
 			model.addAttribute("html", html);
 			return SHOW_HTML_VIEW;
@@ -175,6 +178,9 @@ public String handlePath(String path, HttpServletRequest request, HttpServletRes
 
 			return "/module/uiframework/uiError";
 		}
+		finally {
+			Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+		}
 	}
 
 	private void setRedirectUrl(HttpServletRequest request) {