SOLR-8167: Authorization framework does not work with POST params

git-svn-id: https://svn.apache.org/repos/asf/lucene/dev/trunk@1709056 13f79535-47bb-0310-9956-ffa450edef68

solr/CHANGES.txt

@@ -275,6 +275,9 @@ Bug Fixes
 * SOLR-8050: Partial update on document with multivalued date field fails to parse date and can
   also fail to remove dates in some cases. (Burkhard Buelte, Luc Vanlerberghe, shalin)
 
+* SOLR-8167: Authorization framework does not work with POST params (noble)
+
+  
 Optimizations
 ----------------------
 

solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java

@@ -460,7 +460,7 @@ public class RuleBasedAuthorizationPlugin implements AuthorizationPlugin, Config
           "    update :{" +
           "      path:'/update/*'}," +
           "    read :{" +
-          "      path:['/update/*', '/get']}," +
+          "      path:['/select', '/get']}," +
           "    config-edit:{" +
           "      method:POST," +
           "      path:'/config/*'}}");

solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java

@@ -957,7 +957,7 @@ public class HttpSolrCall {
     return new AuthorizationContext() {
       @Override
       public SolrParams getParams() {
-        return getQueryParams();
+        return solrReq.getParams();
       }
 
       @Override

solr/core/src/test/org/apache/solr/security/BasicAuthIntegrationTest.java

@@ -164,6 +164,13 @@ public class BasicAuthIntegrationTest extends TestMiniSolrCloudClusterBase {
       fail("must have failed");
     } catch (HttpSolrClient.RemoteSolrException e) {
 
+    }
+    reload.setMethod(SolrRequest.METHOD.POST);
+    try {
+      rsp = solrClient.request(reload);
+      fail("must have failed");
+    } catch (HttpSolrClient.RemoteSolrException e) {
+
     }
     cloudSolrClient.request(new CollectionAdminRequest.Reload()
         .setCollectionName(defaultCollName)