Changeset 1627 for trunk/grails-app

Timestamp:

Mar 11, 2011, 2:14:29 PM (12 years ago)

Author:

work@…

Message:

• deny all access to /query except in development

File:

• trunk/grails-app/conf/BaseFilters.groovy (modified) (2 diffs)

trunk/grails-app/conf/BaseFilters.groovy

@@ -14 +14 @@
  * $Date$
  */
+import org.codehaus.groovy.grails.commons.GrailsApplication
+
 class BaseFilters {
         def authenticationService
@@ -53 +55 @@
                         }
                 }
+
+                // disable all access to the query controller as this allows
+                // full access to the database
+                query(controller: 'query', action: '*') {
+                        // before every execution
+                        before = {
+                                // only allow development
+                                if (grails.util.GrailsUtil.environment != GrailsApplication.ENV_DEVELOPMENT) {
+                                        redirect(controller: 'home')
+                                }
+                        }
+                }
                 
                 profiler(controller: '*', action: '*') {