This is an automated email from the ASF dual-hosted git repository.
morrySnow pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 67ada0ac6e3 [fix](config) Restrict frontend config updates to root in
cloud mode (#66478)
67ada0ac6e3 is described below
commit 67ada0ac6e3a56796000317f571b0810c179e54e
Author: Gavin Chou <[email protected]>
AuthorDate: Tue Aug 11 12:11:45 2026 +0800
[fix](config) Restrict frontend config updates to root in cloud mode
(#66478)
### What problem does this PR solve?
Problem Summary:
The Nereids migration of `ADMIN SET FRONTEND CONFIG` retained the global
`ADMIN` privilege check but omitted the cloud-mode root-only restriction
from the legacy DDL executor. This PR restores that restriction: in
cloud mode, an ordinary admin is rejected and root remains allowed.
Non-cloud behavior is unchanged.
### Release note
Restrict `ADMIN SET FRONTEND CONFIG` to root in cloud mode.
---
.../commands/AdminSetFrontendConfigCommand.java | 8 +++++++
.../AdminSetFrontendConfigCommandTest.java | 27 ++++++++++++++++++++++
2 files changed, 35 insertions(+)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
index f967d28e2d9..e215fe56b3f 100644
---
a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
+++
b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
@@ -20,10 +20,13 @@ package org.apache.doris.nereids.trees.plans.commands;
import org.apache.doris.analysis.RedirectStatus;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.AnalysisException;
+import org.apache.doris.common.Config;
import org.apache.doris.common.ConfigBase;
+import org.apache.doris.common.DdlException;
import org.apache.doris.common.ErrorCode;
import org.apache.doris.common.ErrorReport;
import org.apache.doris.common.UserException;
+import org.apache.doris.mysql.privilege.Auth;
import org.apache.doris.mysql.privilege.PrivPredicate;
import org.apache.doris.nereids.trees.plans.PlanType;
import org.apache.doris.nereids.trees.plans.visitor.PlanVisitor;
@@ -92,6 +95,11 @@ public class AdminSetFrontendConfigCommand extends Command
implements Redirect {
if (type != NodeType.FRONTEND) {
throw new AnalysisException("Only support setting Frontend configs
now");
}
+
+ if (Config.isCloudMode()
+ &&
!ConnectContext.get().getCurrentUserIdentity().getUser().equals(Auth.ROOT_USER))
{
+ throw new DdlException("Unsupported operation");
+ }
}
@Override
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
index 54e47ac0540..a6231a05b6b 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
@@ -18,6 +18,7 @@
package org.apache.doris.nereids.trees.plans.commands;
import org.apache.doris.analysis.RedirectStatus;
+import org.apache.doris.analysis.UserIdentity;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.AnalysisException;
import org.apache.doris.common.CaseSensibility;
@@ -46,6 +47,32 @@ public class AdminSetFrontendConfigCommandTest extends
TestWithFeService {
.startsWith("ADMIN SET FRONTEND CONFIG"));
}
+ @Test
+ public void testCloudAdminCannotSetFrontendConfig() {
+ String originalDeployMode = Config.deploy_mode;
+ String originalCloudUniqueId = Config.cloud_unique_id;
+ boolean originalEnableUdfInLoad = Config.enable_udf_in_load;
+ UserIdentity originalUserIdentity =
connectContext.getCurrentUserIdentity();
+ try {
+ Config.deploy_mode = "cloud";
+ Config.cloud_unique_id = "";
+ connectContext.setCurrentUserIdentity(UserIdentity.ADMIN);
+
+ IllegalStateException exception =
Assertions.assertThrows(IllegalStateException.class,
+ () -> executeSql("admin set frontend
config(\"enable_udf_in_load\" = \"true\");"));
+ Assertions.assertEquals("errCode = 2, detailMessage = Unsupported
operation", exception.getMessage());
+
+ connectContext.setCurrentUserIdentity(UserIdentity.ROOT);
+ Assertions.assertDoesNotThrow(
+ () -> executeSql("admin set frontend
config(\"enable_udf_in_load\" = \"true\");"));
+ } finally {
+ connectContext.setCurrentUserIdentity(originalUserIdentity);
+ Config.deploy_mode = originalDeployMode;
+ Config.cloud_unique_id = originalCloudUniqueId;
+ Config.enable_udf_in_load = originalEnableUdfInLoad;
+ }
+ }
+
@Test
public void testRedirectStatus() {
String sql = "admin set frontend config(\"alter_table_timeout_second\"
= \"60\");";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
