Carlo
aac22ec9bc
Software title details now return installer scripts and managed app configuration only to users who can read the installer. Uninstalling software from the My device page now applies the same self-service and label scope rules as installing. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security & Permissions** * Restricted installer scripts, managed-app settings, and related configuration to authorized viewers. * Preserved package metadata while hiding sensitive installation details from unauthorized roles. * Improved access handling for requests without an assigned team or involving inaccessible fleets. * **Bug Fixes** * Updated device-initiated software removal to honor self-service eligibility and label scope. * Added clearer errors when software is unavailable for self-service or outside the device’s scope. * Prevented software titles from inaccessible fleets from appearing in results. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
4 lines
959 B
Plaintext
4 lines
959 B
Plaintext
- Fixed the software title details response so that installer script contents and managed app configuration are only returned to users authorized to read the installer, and so that a request without a fleet is authorized against "No team" instead of skipping the scope check. This applies to `GET /api/v1/fleet/software/titles/{id}` and to the `software_title` included in `GET /api/v1/fleet/hosts` when filtering by `software_title_id`.
|
|
- Fixed a software title request without a fleet so that it only resolves titles in fleets the requester can see. Previously a title reachable only through a software package, App Store app, or in-house app in another fleet was returned, which told the requester that software they have no access to exists.
|
|
- Fixed device-authenticated ("My device") software uninstall so that it applies the same self-service and label-scope rules as the self-service install path, instead of accepting any package on the host's fleet.
|