Actions
Issue #8524
closed
Disable guardians' AnonymousUser
Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
Category:
-
Sprint/Milestone:
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
Platform Release:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Sprint 94
Quarter:
Description
The Guardian anonymous user is different from the Django Anonymous user. https://django-guardian.readthedocs.io/en/stable/configuration.html#anonymous-user-name
We are using DRF access policy which evaluetes this user as not anonymous and authenticated, this is a security concern. https://github.com/rsinger86/drf-access-policy/blob/master/rest_access_policy/access_policy.py#L99-L106
Actions
.
Disable django guardian's anonymous user.
closes #8524
Required PR: https://github.com/pulp/pulp-cli/pull/198