locate your applicationContext-security.xml file. It should be located in SUBSONIC\jetty\webapp\WEB-INF\applicationContext-security.xml.
Edit the file and locate this area in the file
- Code: Select all
<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="alwaysReauthenticate" value="true"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="objectDefinitionSource">
<value>
PATTERN_TYPE_APACHE_ANT
/login.view=IS_AUTHENTICATED_ANONYMOUSLY
/accessDenied.view=IS_AUTHENTICATED_ANONYMOUSLY
/stream/**=IS_AUTHENTICATED_ANONYMOUSLY
/style/**=IS_AUTHENTICATED_ANONYMOUSLY
/icons/**=IS_AUTHENTICATED_ANONYMOUSLY
/wap/playerJad.view=IS_AUTHENTICATED_ANONYMOUSLY
/wap/playerJar.view=IS_AUTHENTICATED_ANONYMOUSLY
/generalSettings.view=ROLE_ADMIN
/advancedSettings.view=ROLE_ADMIN
/userSettings.view=ROLE_ADMIN
/musicFolderSettings.view=ROLE_ADMIN
/transcodingSettings.view=ROLE_ADMIN
/internetRadioSettings.view=ROLE_ADMIN
/searchSettings.view=ROLE_ADMIN
/podcastSettings.view=ROLE_ADMIN
/db.view=ROLE_ADMIN
Just for testing purposes add the following line in the list
- Code: Select all
/db.view=IS_AUTHENTICATED_ANONYMOUSLY
Restart subsonic and log in again with the admin-user. Now try accessing the db.view URL I gave you earlier.
If it works it basically means that the security mechanisms in Subsonic does not identify the user "admin" as an admin-user.
I tried this myself and it allowed a non-admin user to access the db.view URL.
