From 20ea476dc76f045b16a3edb86228fe31b49a35a5 Mon Sep 17 00:00:00 2001
From: Arpit Mohan <arpit@appsmith.com>
Date: Thu, 19 Dec 2019 13:04:13 +0530
Subject: [PATCH] Correcting the HTTP methods for the public urls of
 forgotPassword & resetPassword

---
 .../server/configurations/SecurityConfig.java |   6 +++---
 .../resources/public/appsmith/authz/acl.rego  |   6 +++---
 .../src/main/resources/public/bundle.tar.gz   | Bin 1261 -> 1403 bytes
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/SecurityConfig.java b/app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/SecurityConfig.java
index fd37031e3b..28df76c58d 100644
--- a/app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/SecurityConfig.java
+++ b/app/server/appsmith-server/src/main/java/com/appsmith/server/configurations/SecurityConfig.java
@@ -87,9 +87,9 @@ public class SecurityConfig {
                 // This is because the flow enters AclFilter as well and needs to be whitelisted there
                 .matchers(ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, "/login"),
                         ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, USER_URL),
-                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, USER_URL + "/forgotPassword"),
-                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, USER_URL + "/verifyPasswordResetToken"),
-                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, USER_URL + "/resetPassword"))
+                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, USER_URL + "/forgotPassword"),
+                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.GET, USER_URL + "/verifyPasswordResetToken"),
+                        ServerWebExchangeMatchers.pathMatchers(HttpMethod.PUT, USER_URL + "/resetPassword"))
                 .permitAll()
                 .pathMatchers("/public/**").permitAll()
                 .anyExchange()
diff --git a/app/server/appsmith-server/src/main/resources/public/appsmith/authz/acl.rego b/app/server/appsmith-server/src/main/resources/public/appsmith/authz/acl.rego
index e28ec299fc..8302662c78 100644
--- a/app/server/appsmith-server/src/main/resources/public/appsmith/authz/acl.rego
+++ b/app/server/appsmith-server/src/main/resources/public/appsmith/authz/acl.rego
@@ -23,10 +23,10 @@ url_allow = true {
 
 # All public URLs must go into this list. Anything not in this list requires an authenticated session to access
 public_operations = [
-    {"method" : "POST", "url" : "/api/v1/users/forgotPassword" },
+    {"method" : "GET", "url" : "/api/v1/users/forgotPassword" },
     {"method" : "POST", "url" : "/api/v1/users" },
-    {"method" : "POST", "url" : "/api/v1/users/verifyPasswordResetToken" },
-    {"method" : "POST", "url" : "/api/v1/users/resetPassword" },
+    {"method" : "GET", "url" : "/api/v1/users/verifyPasswordResetToken" },
+    {"method" : "PUT", "url" : "/api/v1/users/resetPassword" },
 ]
 
 # This is a global list of all the routes for all controllers. Any new controller that is written must
diff --git a/app/server/appsmith-server/src/main/resources/public/bundle.tar.gz b/app/server/appsmith-server/src/main/resources/public/bundle.tar.gz
index 68b8ba98b98bff48c507ae80df9e1a17c46d6772..58618889e96fbd56e106790478a731c816663029 100644
GIT binary patch
literal 1403
zcmV->1%&z^iwFQPBl}$d1MQeiZ`(E)$9s)F1(6+gSfJR6?EnRO$kuEakTqGFB8MOd
zXo<Fo(4tCG@zf&UeGe(>%`zDRYc^~PFSbbP_q_c1&?a%7%QaQ2!#6M2Mx)Wmbc)R9
ztoj@sO{!1Z(D-;d9gmJiv&jsN#>eB?$s06%L7$pdNQDKsf<;c1XC6#jEIi{jj^^`U
z(r~RmF4XGF%dCPx{ZD4Iqw(bE1oWRAA5UNP|2x{2{y1T=AWQyDZ9qO|lZi|J@zK$A
zyruv2WP1DtjlQWDj`ly-KgY=fUJ_KVgV?NtC`!o!7fhi-uzSoH-=KGBfte)Dh#-;|
zA|YGD(Rb*2MI{mi1F9a9NUaDeBoRn)gp-6wiAa{_oMuX*IhG_vJTtR$BGyz&$}{~I
zR=Tr9SO5xoml;W8V}PKQQu%L0t$2!XmNwp0bD0D~83I083d~TBg+hE`jnixiT=4Pq
zr*oj)5X2veU>v8$2jh7gH*^UyFVPx5=ohKd<clkm@GPYYJdM#A)sxyV0gdMXX~Q*K
z>mrzZq*!-Rfpoe_rf7l{WI+-W`vKwrQQrdw<;9%QMEg@EM6;_XtOWwTmvf$$anuz{
ziGrZ75rW2Zc<vdx=a6WuotL-wcV-gJ@<PSyDx>e<9s9jA*yPv@H{s|B+Cnu+Cm`;~
zSo8Dht#%}Oio6b2fjd3b2{A<Y;t$|SugO!!>QsKZI+th-b&r-@FA-iX21ccd(P>t~
z6X=|A$aU5Zfqb6}3PEf6cdFLP9SwX3hi;9RU-v7o_R(9k|I69+{sG#D2+ZRl&gtRf
z_)w=%9xk|8a&-yoe!~UKe>xZfE-ya13A<nM+JvP<7iDepib$fa`2)!u)<1brLciSe
z{;t^@^cqG>#^+F)CbzmY8LO&<7YdRL(VH%)G9@@;fHdNujBGlcO-*bBRf=RrS1^-c
zAxf<js03eXA)yzSF}k=s)jJK?Ses3t-Gl6=AtXt(ZrU+$N)p4NM*Ot9Nr5TjX;t?>
z^!6{B!KOg<0<q<emJnRtZfxylQEyOj<SNtQ0_w<Lm!j^gq=(Md72TZ(0>rn~=(d>c
zvIrmnD0Oq}nh4+&dD`<RC_1PKoY5~;PMlHpXN5)k4B15eEO(d7`e&=i!+i~LHiw^V
zmy^|4pmPq8_05eMs_Y<Hl^aq>bPSiU3Ao~`M*|~t!fcE_+%QTf&BocG1?ebsg)8b7
zvz-vCs0Ufg>WA*o*2Am??lD7R$BD1h>e0ZcoiH1+4>ye0NwdLvXz$O?&#upcfhl36
z4-83N{oR$kc04eB9-vL2A302+hiH@7BL)=<E0)x`VCvD(GI7D`8u8$E6o`vfS4T?=
zDvdm6`X7L=KDtvvi^PkqE9E)xj&kvG>zdi(hUB68zvRe(9Sn@!g|bn5V8eJ_EE{Rd
z3W+h%|6{#dVRuGgv|gwU`8n(`ZZFjazeNqn0KA9&`&oBJU<SNUn}O%B!wh(-HUnGK
zur-h^=+do!H5#nF1J>y7#_iJFL2LB3v`C-tdY3=uU~}{9r9Kx|w$aDm&(Y_Cn3Gih
z-iO2H04KAb;V?!1!0VimgZ7BD#wD8D+a!1gc#^=QIXi+$IHU=Zz%kPvt$4=te8%-X
zk3QX#wK=zaxVUbQnbiw1x>?cQb&qj<Lt$ET{j+s<1s2U=a#3Vvp<_l>dC<G!8L(D_
z<$$U4u+eu)C}9}LQj>L3N`rX+V;l{x*6iKL-qsz5Sxa?q=XS;(xuQLrvD-r4>1&YA
zqox)5RH>J%xwMJ){FgXp*sMsv*kjvYhZZuXX@3e$JGL4_|MW%aYkO_4?X~^K+MkP^
Jy^#PQ008G6z|{Z%

literal 1261
zcmV<J1QPoniwFRCQ21Q{1MQewZ`(E$fcqN#3L<-4Aj^sE00sJxt=TXjTf8+xAA%rY
zB-$oQiyBGAb&LM@9bRNfR>-iIY#0_IfGzUy<GCt6#8oBNRINrYo^E7Wb~>FR^EtDh
z+401Fx`D<g)9E-n&SsMt%El+-+35>3eL|gfqm~K_Pz8&Ms(>7bEf#@wXUFdIKQeF=
ze_X58ho{Mc$oQYmvS~J+Wf1?#$??f^{Qrru7k`|yRFEbAre}aZW|N68{^Rj<wjclL
z=>+1ReN!zw<9{Ci3g_?elAtCJQj-TsQji6%nL@Q-x0o@$L9fsPGf8$Uf=FJAoa`+p
z-=V7&l}OYKsCr2vwIZmNL?Fcx&T}FqB4tr=S}KX|up|ZIrID(LSW_t}FZC|0^yC&{
z0VtSVmZV6{0R*j-s(vME#S4VXVyBIjWfBf55%9@UV1_Cz6yghaI4zgJ1s%_RyhyqR
zDp3>kF+nhR1<%?Sq*OG=iWIjTl*3A^c71zeglJjSDqUMGUcnysy|cK}%PcofMnIon
zg|u(dj_D1*vb)-q<Wmw<xT^0M&Apn!R!f90VFTct0Sg4K&90A!R_YMFM2GXsH&=&8
z=n#<Rd4wxEx*w0UO>(s0V#(DUg16xUHhenzOu`pz8Ql{>7u)90KZqpiioYY}m#~E1
z-P8YOm*Vh;(US2y$S_8w%`nDHA`4zCA`#ecrgB~?!5IT&iq6U{D#@lZX>%QT8$p#K
zC0fI4369CJ5L=zekcIGtmNsu;7H?B@IX}|{181yFF1MxRa$iW2>(FV%Kq*NKhk{<Z
zWI724M;T3Rm44qVLt3uDpHKkko?>I$5{#?b`m~#jGhCgeiLY{oIn;?jQyqHF1|KF{
zRrGW&2oPV|)%|F~`p@UFBmfnD&iv0<PF)o}jiRiBs=y`vV144XvM&{9?IUDk^`qQ}
zRMv0bx{B8|M%fDf^Z1msYmv%%Ku$M5Y8Yh?$whfbim{I2ExZJL_BE@K7J6aM#t?33
zrI+UH?9ig(D0GD@>JMfs5F60|vI%P#`ao<0%qGA+W{mAP50zT88fmo`=1dOZhW2`C
z&e#C$_4&p5)p<0qAdK{ZF|KRA`<&OVN4hTnbPfz7hb{~dofCV+sA6IDl6n)SS&c0d
zAFQd70PcYT@zI*<XlYTUQB_R;0tnSdS0uJbg4m`~9s@s6E<tWnGke?^KiJ<(9uK(1
zNZWlVXLSHJwAaUSmbR=I8*}|THux&+N<>;4ggTQS!w&5ZQl0U8)EE!IJ{*3ZbtNJ_
z5QI7pJcb>5AV_r{*rUefK)IkxfBfxgbnHE_UEKY+hhpxb?c(idiSF-ucNnIzdHc&;
zUtZX=(VO2d&|ft%omBt&g2T%JI<udknIiA;x?<$0ZIRY^i|*W|2<!o#B=Bf@M>rCi
zG(mD`GhJ)NOQz)+*Vh$XW7ei``|a|oZ8PnL6un(h(6zlAFsg4Th}q}i6%3qcn#o07
znncHps_l`Z_O5nX){3wSFpVEJ&>0exGYn*@$=WGfgLwTznhb7;+;zpl-nE0trDnEs
zVd7e@<iL6Cx|TQkW}@?`X|?Vub-J2+l;j|MuVR)>MgqpQZC?+qWlD>_2rW8i?GF04
X@B5y|^LQT5qZxk#C~5^n03HAUrh8<l