det101 commented on code in PR #18566:
URL:
https://github.com/apache/dolphinscheduler/pull/18566#discussion_r3809890646
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/TaskDefinitionServiceImpl.java:
##########
@@ -362,6 +367,7 @@ public Long updateTaskWithUpstream(User loginUser, long
projectCode, long taskCo
notExistTaskCodes);
throw new ServiceException(Status.TASK_DEFINE_NOT_EXIST,
notExistTaskCodes);
}
+ taskDatasourcePermissionChecker.checkPermission(loginUser,
upstreamTaskDefinitionList);
Review Comment:
Thanks for adding the shared datasource check — this looks like a good fix
overall.
One small question on this line: `upstreamTaskDefinitionList` here is used
to rewrite DAG edges (`preTaskCode` / version), not to connect those upstream
datasources. The current task is already validated in `updateTask(...)`.
If I understand correctly, this might false-reject a user who can edit the
workflow but does not own the upstream SQL/RemoteShell datasource. Would it
make sense to drop this check, or is there a case I am missing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
