protect getAll methods

2025-11-11 07:55:47 +01:00 · 2011-06-09 22:11:59 +02:00
parent 1edd0e8768
commit 637bc373b5
2 changed files with 4 additions and 0 deletions
--- a/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java
+++ b/scm-webapp/src/main/java/sonia/scm/user/xml/XmlUserManager.java
@@ -443,6 +443,8 @@ public class XmlUserManager extends AbstractUserManager
  public Collection<User> getAll(Comparator<User> comaparator, int start,
                                 int limit)
  {
+    SecurityUtil.assertIsAdmin(scurityContextProvider);
+
    return Util.createSubCollection(userDB.values(), comaparator,
                                    new CollectionAppender<User>()
    {