TRUNK-6203: Global properties access should be privileged

openmrs · Aug 8, 2024 · a788bfa · a788bfa
1 parent ed17026
commit a788bfa
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/omod-common/src/main/java/org/openmrs/module/webservices/rest/web/RestUtil.java b/omod-common/src/main/java/org/openmrs/module/webservices/rest/web/RestUtil.java
@@ -840,8 +840,15 @@ public static SimpleObject wrapErrorResponse(Exception ex, String reason) {
 		StackTraceElement[] stackTraceElements = ex.getStackTrace();
 		if (stackTraceElements.length > 0) {
 			StackTraceElement stackTraceElement = ex.getStackTrace()[0];
-			String stackTraceDetailsEnabledGp = Context.getAdministrationService()
-					.getGlobalPropertyValue(RestConstants.ENABLE_STACK_TRACE_DETAILS_GLOBAL_PROPERTY_NAME, "false");
+			String stackTraceDetailsEnabledGp = null;
+			try {
+				Context.addProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+				stackTraceDetailsEnabledGp = Context.getAdministrationService()
+						.getGlobalPropertyValue(RestConstants.ENABLE_STACK_TRACE_DETAILS_GLOBAL_PROPERTY_NAME, "false");
+			}
+			finally {
+				Context.removeProxyPrivilege(PrivilegeConstants.GET_GLOBAL_PROPERTIES);
+			}
 			map.put("code", stackTraceElement.getClassName() + ":" + stackTraceElement.getLineNumber());
 			if ("true".equalsIgnoreCase(stackTraceDetailsEnabledGp)) {
 				map.put("detail", ExceptionUtils.getStackTrace(ex));