ruanwenjun opened a new pull request, #18212: URL: https://github.com/apache/dolphinscheduler/pull/18212
<!--Thanks very much for contributing to Apache DolphinScheduler, we are happy that you want to help us improve DolphinScheduler! --> ## Was this PR generated or assisted by AI? YES, ops 4.7 ## Purpose of the pull request close #18211 The view-gantt / view-variables endpoints on WorkflowInstanceController and the start-workflow-instance / batch-start-workflow-instance endpoints on ExecutorController did not verify that the login user had permission on the URL projectCode, allowing any authenticated user to read another project's workflow instance details or trigger another project's online workflows. * WorkflowInstanceServiceImpl#viewVariables/viewGantt now require loginUser and check projectService.checkProjectAndAuth with WORKFLOW_INSTANCE before reading the instance. * WorkflowTriggerRequest / WorkflowBackFillRequest carry the URL projectCode. ExecutorServiceImpl#triggerWorkflowDefinition / backfillWorkflowDefinition gate the call with checkProjectAndAuthThrowException(RERUN) and reject when the resolved workflowDefinition does not belong to that projectCode. * ExecutorController and PythonGateway propagate projectCode into the request builders. batchTriggerWorkflowDefinitions also accepts the path variable so the inner per-code call inherits it. * New ExecutorServiceTest covers the unauthorized and cross-project trigger/backfill paths; existing WorkflowInstance tests are updated to the new viewVariables/viewGantt signatures. ## Brief change log <!--*(for example:)* - *Add maven-checkstyle-plugin to root pom.xml* --> ## Verify this pull request <!--*(Please pick either of the following options)*--> This pull request is code cleanup without any test coverage. *(or)* This pull request is already covered by existing tests, such as *(please describe tests)*. (or) This change added tests and can be verified as follows: <!--*(example:)* - *Added dolphinscheduler-dao tests for end-to-end.* - *Added CronUtilsTest to verify the change.* - *Manually verified the change by testing locally.* --> (or) ## Pull Request Notice [Pull Request Notice](https://github.com/apache/dolphinscheduler/blob/dev/docs/docs/en/contribute/join/pull-request.md) If your pull request contains incompatible change, you should also add it to `docs/docs/en/guide/upgrade/incompatible.md` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
