View item – ProjectTasks

ContentType: ContentType.ProjectTask Item: SPF.29

Title

SPF.29 Gate the admin pages Central Administration links

CreatedAt

(empty)

Author

(empty)

TaskNumber

SPF.29

ProjectCode

SPFIDELITY

TaskTitle

Admin security gaps found by the SPF.28 recon. POST /_admin/sites/{site}/properties, properties/delete and theme have no permission check. GET /admin/farm/permissions, /admin/services and /admin/seats are open to any caller, although Central Administration, which links them, is farm-admin only. Gate them: farm pages on SitePolicy.IsFarmAdministrator, site pages on Full Control of the site.

AssigneeSku

(empty)

DueDate

(empty)

EstimateHours

(empty)

Status

Completed

Body

Admin security gaps found by the SPF.28 recon. POST /_admin/sites//properties, properties/delete and theme have no permission check. GET /admin/farm/permissions, /admin/services and /admin/seats are open to any caller, although Central Administration, which links them, is farm-admin only. Gate them: farm pages on SitePolicy.IsFarmAdministrator, site pages on Full Control of the site.

AssignedTo

(empty)

Parent task

(empty)

PercentComplete

(empty)

Comments

(empty)

Predecessors

(empty)

Projects › Lists › ProjectTasks › View item