mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-22 08:02:19 +00:00
0b1c280884
The POST /api/settings/test_object_storage_config endpoint was accessible to any authenticated user without requiring super admin privileges. This allowed SSRF by connecting to a user-specified S3 endpoint URL. Add the same require_super_admin check used by all other settings endpoints. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>