nsqadmin: non admin user can delete the topic on a node

[guishoudaoge]

Hi Team

On the nsqadmin UI page, Non admin user can see the delete icon and delete the topic on a node successfully

tombstoneNodeForTopicHandler is not protected by isAuthorizedAdminRequest

Thanks
/Joe

[mreiferson]

Yep, it also doesn't present a confirmation dialog.

[SandroJijavadze]

If admin-user option is set on nsqadmin I can't see option to delete user with non-admin user.

[yai-dev]

@mreiferson I cloned the latest master branch and tried to delete the topic and channel with the admin option enabled, the API responds FORBEDDEN, it looks like this bug has been fixed and this issue should be closed.

[mreiferson]

@suenchunyu the request handler tombstoneNodeForTopicHandler is still missing the admin check, so it can't be fixed...