switching to contravariance for security of the plugin. resulting dis… (

#5840)
mesosphere · Dec 22, 2017 · 6392216 · 6392216
1 parent c0eb0e3
commit 6392216
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/plugin-interface/src/main/scala/mesosphere/marathon/plugin/auth/AuthorizedAction.scala b/plugin-interface/src/main/scala/mesosphere/marathon/plugin/auth/AuthorizedAction.scala
@@ -8,7 +8,7 @@ import mesosphere.marathon.plugin.{ Group, RunSpec }
   *
   * @tparam R the type of the resource.
   */
-sealed trait AuthorizedAction[+R]
+sealed trait AuthorizedAction[-R]
 
 /**
   * The following objects will be passed to the Authorizer when an action affects an application, in order to identify
@@ -35,4 +35,3 @@ case object CreateResource extends AuthorizedAction[AuthorizedResource]
 case object UpdateResource extends AuthorizedAction[AuthorizedResource]
 case object DeleteResource extends AuthorizedAction[AuthorizedResource]
 case object ViewResource extends AuthorizedAction[AuthorizedResource]
-
diff --git a/src/main/scala/mesosphere/marathon/api/v2/GroupsResource.scala b/src/main/scala/mesosphere/marathon/api/v2/GroupsResource.scala
@@ -277,7 +277,7 @@ class GroupsResource @Inject() (
       val maybeExistingGroup = result(groupManager.group(group.id))
       val updatedGroup = groupUpdate.apply(group, newVersion)
 
-      maybeExistingGroup.fold(checkAuthorization(CreateRunSpec, updatedGroup))(checkAuthorization(UpdateGroup, _))
+      maybeExistingGroup.fold(checkAuthorization(CreateGroup, updatedGroup))(checkAuthorization(UpdateGroup, _))
 
       rootGroup.putGroup(updatedGroup, newVersion)
     }