nixonrodrigues commented on code in PR #675:
URL: https://github.com/apache/atlas/pull/675#discussion_r3630755190
##########
webapp/src/main/java/org/apache/atlas/web/resources/AdminResource.java:
##########
@@ -1050,14 +1066,18 @@ public List<AtlasEntityHeader>
getAuditDetails(@PathParam("auditGuid") String au
@GET
@Path("activeSearches")
@Produces(Servlets.JSON_MEDIA_TYPE)
- public Set<String> getActiveSearches() {
+ public Set<String> getActiveSearches() throws AtlasBaseException {
+ AtlasAuthorizationUtils.verifyAccess(new
AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "active searches");
+
return activeSearches.getActiveSearches();
}
@DELETE
@Path("activeSearches/{id}")
@Produces(Servlets.JSON_MEDIA_TYPE)
- public boolean terminateActiveSearch(@PathParam("id") String searchId) {
+ public boolean terminateActiveSearch(@PathParam("id") String searchId)
throws AtlasBaseException {
+ AtlasAuthorizationUtils.verifyAccess(new
AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "terminate active
search");
Review Comment:
Please remove this authz. Search do not have authz. if authz added here. The
user can make search calls but not able to terminate the search Rest.
##########
webapp/src/main/java/org/apache/atlas/web/resources/AdminResource.java:
##########
@@ -1050,14 +1066,18 @@ public List<AtlasEntityHeader>
getAuditDetails(@PathParam("auditGuid") String au
@GET
@Path("activeSearches")
@Produces(Servlets.JSON_MEDIA_TYPE)
- public Set<String> getActiveSearches() {
+ public Set<String> getActiveSearches() throws AtlasBaseException {
+ AtlasAuthorizationUtils.verifyAccess(new
AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "active searches");
Review Comment:
Please remove this authz, this returns only authenticated user's search Ids(
threadId's) and do not expose other information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
