det101 commented on code in PR #18566:
URL:
https://github.com/apache/dolphinscheduler/pull/18566#discussion_r3809890646
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskDefinitionServiceImpl.java:
##########
@@ -362,6 +367,7 @@ public Long updateTaskWithUpstream(User loginUser, long
projectCode, long taskCo
notExistTaskCodes);
throw new ServiceException(Status.TASK_DEFINE_NOT_EXIST,
notExistTaskCodes);
}
+ taskDatasourcePermissionChecker.checkPermission(loginUser,
upstreamTaskDefinitionList);
Review Comment:
This check looks too broad for `updateTaskWithUpstream`.
This list is the **upstream/pre-task** definitions used only to rewrite DAG
edges (`preTaskCode` / version). Changing a dependency does not mean the
current user will access those upstream tasks' datasources.
The task being saved is already validated in `updateTask(...)`. Checking
`upstreamTaskDefinitionList` here can false-reject a legitimate edge update
when the editor has project write permission but not the upstream
SQL/RemoteShell datasource.
Suggest dropping this line:
```java
taskDatasourcePermissionChecker.checkPermission(loginUser,
upstreamTaskDefinitionList);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
