kylin-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Billy Liu (JIRA)" <j...@apache.org>
Subject [jira] [Reopened] (KYLIN-2938) Project Update ACL issue
Date Thu, 25 Jan 2018 06:17:00 GMT

     [ https://issues.apache.org/jira/browse/KYLIN-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Billy Liu reopened KYLIN-2938:
------------------------------

> Project Update ACL issue
> ------------------------
>
>                 Key: KYLIN-2938
>                 URL: https://issues.apache.org/jira/browse/KYLIN-2938
>             Project: Kylin
>          Issue Type: Bug
>          Components: REST Service
>    Affects Versions: v2.1.0
>            Reporter: Pan, Julian
>            Assignee: Pan, Julian
>            Priority: Major
>
> I noticed there different security between updateProject and renameProject in ProjectService.
> @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or hasPermission(#currentProject, 'ADMINISTRATION')
or hasPermission(#currentProject, 'MANAGEMENT')")
> updateProject
>  @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or hasPermission(#currentProject, 'ADMINISTRATION')")
> renameProject
> Even updateProject will call renameProject. Which will throws exception if user is MANAGEMENT
role.
> The renameProject should be same security check with updateProject.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message