Mailing-List: contact commits-help@airflow.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@airflow.incubator.apache.org
Date: Sun, 9 Oct 2016 08:15:20 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: commits@airflow.incubator.apache.org
Message-ID: <JIRA.13006067.1474326645000.776121.1476000920591@Atlassian.JIRA>
In-Reply-To: <JIRA.13006067.1474326645000@Atlassian.JIRA>
References: <JIRA.13006067.1474326645000@Atlassian.JIRA> <JIRA.13006067.1474326645593@arcas>
Subject: [jira] [Commented] (AIRFLOW-518) Require DataProfilingMixin for the
 Variables CRUD access
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Sun, 09 Oct 2016 08:15:26 -0000


    [ https://issues.apache.org/jira/browse/AIRFLOW-518?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15559562#comment-15559562 ] 

ASF subversion and git services commented on AIRFLOW-518:
---------------------------------------------------------

Commit 941500e14f4e327cbae0b404515597afa04ade60 in incubator-airflow's branch refs/heads/master from [~maxime.beauchemin@apache.org]
[ https://git-wip-us.apache.org/repos/asf?p=incubator-airflow.git;h=941500e ]

[AIRFLOW-518] Require DataProfilingMixin for Variables CRUD

Many of us use the "Variable" model CRUD
(create/update/delete) as a k/v
store to power frameworks that read these values
to dynamically generate
pipelines.

With the basic "LoginMixin" role (lowest level of
access to Airflow)
having access to the Variable CRUD, people could
easily alter a Variable
to run arbitrary code on the platform, depending
on how variables are
use in that environment.

It's a safer bet to elevate CRUD on Variable to
DataProfilingMixin, and
make sure that the lowest level of access cannot
interfere with these
Variables.

Closes #1804 from mistercrunch/elevate_variables


> Require DataProfilingMixin for the Variables CRUD access
> --------------------------------------------------------
>
>                 Key: AIRFLOW-518
>                 URL: https://issues.apache.org/jira/browse/AIRFLOW-518
>             Project: Apache Airflow
>          Issue Type: Improvement
>            Reporter: Maxime Beauchemin
>
> Many of us use the "Variable" model CRUD (create/update/delete) as a k/v store to power frameworks that read these values to dynamically generate pipelines. 
> With the basic "LoginMixin" role (lowest level of access to Airflow) having access to the Variable CRUD, people could easily alter a Variable to run arbitrary code on the platform, depending on how variables are use in that environment.
> It's a safer bet to elevate CRUD on Variable to DataProfilingMixin, and make sure that the lowest level of access cannot interfere with these Variables.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)