Hi all, I'd like to share a bug fix introduced by the following PR:
- Master: https://github.com/apache/iotdb/pull/18359 This bug affects the tree-model SHOW QUERIES and KILL QUERY statements: an unprivileged user (one who does not pass the MAINTAIN authorization check) could view or kill *other* users' queries, while a privileged user was conversely restricted to only their own queries. The root cause is an inverted condition in TreeAccessCheckVisitor: - visitShowQueries and visitKillQuery called statement.setAllowedUsername(context.getUsername()) when the MAINTAIN check *succeeded* instead of when it *failed*. - As a result, a user who failed the MAINTAIN check got no allowedUsername filter (and could see/kill everyone's queries), while a user who passed it was unnecessarily scoped to their own queries only. The fix negates the condition, so the intended rules now apply: - If the MAINTAIN check fails, the statement is restricted to the current user's queries (allowedUsername is set). - If the check succeeds, no restriction is applied (view/kill all users' queries). - Users with the SYSTEM privilege (which contains the deprecated MAINTAIN privilege) can view and kill queries from all users. Main changes include: - Fix the inverted condition in TreeAccessCheckVisitor.visitShowQueries and visitKillQuery. - Add IoTDBShowQueriesIT with showQueriesAuthTest and killQueryAuthTest, using queries that remain active across Session fetches (result sets left unconsumed), and verifying visibility/kill permissions before and after granting SYSTEM (without granting deprecated MAINTAIN directly). Feedback and suggestions are welcome. 大家好， 我想分享以下 PR 中修复的一个权限过滤问题： - Master：https://github.com/apache/iotdb/pull/18359 该问题影响树模型的 SHOW QUERIES 与 KILL QUERY 语句：未通过 MAINTAIN 权限检查的普通用户可以查看或终止*其他用户* 的查询，而拥有权限的用户反而被限制为只能查看自己的查询。 根本原因是 TreeAccessCheckVisitor 中条件写反了： - visitShowQueries 与 visitKillQuery 在 MAINTAIN 权限检查*通过*时才调用 statement.setAllowedUsername(context.getUsername())，而不是在*失败*时调用。 - 因此，未通过检查的用户没有得到 allowedUsername 过滤（可以看到/终止所有人的查询），而通过检查的用户反而被不必要地限制为只能查看自己的查询。 本次修复将条件取反，使预期规则正确生效： - 若 MAINTAIN 检查失败，则限制为仅当前用户的查询（设置 allowedUsername）。 - 若检查通过，则不做限制（可查看/终止所有用户的查询）。 - 拥有 SYSTEM 权限（其中包含已废弃的 MAINTAIN 权限）的用户可以查看和终止所有用户的查询。 主要修改包括： - 修复 TreeAccessCheckVisitor.visitShowQueries 与 visitKillQuery 中写反的条件。 - 新增 IoTDBShowQueriesIT，包含 showQueriesAuthTest 与 killQueryAuthTest，使用跨 Session 拉取仍保持活跃的查询（结果集不消费完），并在授予 SYSTEM 权限前后验证可见性与终止权限（不直接授予已废弃的 MAINTAIN ）。 欢迎大家提出反馈和建议。 Best regards, Wenwei Shu
