TRUNK-6203: Global properties access should be privileged

ManojLL · Jun 26, 2024 · 4df6afd · 4df6afd
1 parent 95051a0
commit 4df6afd
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/web/src/main/java/org/openmrs/web/filter/GZIPFilter.java b/web/src/main/java/org/openmrs/web/filter/GZIPFilter.java
@@ -19,6 +19,7 @@
 import org.openmrs.api.APIException;
 import org.openmrs.api.context.Context;
 import org.openmrs.util.OpenmrsConstants;
+import org.openmrs.util.PrivilegeConstants;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.filter.OncePerRequestFilter;
@@ -124,6 +125,8 @@ private boolean isGZIPEnabled() {
 		}
 
 		try {
+			Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+
 			String gzipEnabled = Context.getAdministrationService().getGlobalProperty(
 			    OpenmrsConstants.GLOBAL_PROPERTY_GZIP_ENABLED, "");
 
@@ -137,6 +140,9 @@ private boolean isGZIPEnabled() {
 
 			return false;
 		}
+		finally {
+			Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+		}
 	}
 
 	/**