pradeepagrawal8184 commented on code in PR #993:
URL: https://github.com/apache/ranger/pull/993#discussion_r3533951079
##########
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java:
##########
@@ -855,30 +854,8 @@ public VXUser getXUserByUserName(@Context
HttpServletRequest request, @PathParam
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" +
RangerAPIList.GET_X_GROUP_BY_GROUP_NAME + "\")")
public VXGroup getXGroupByGroupName(@Context HttpServletRequest request,
@PathParam("groupName") String groupName) {
VXGroup vXGroup =
xGroupService.getGroupByGroupName(groupName);
- UserSessionBase userSession = ContextUtil.getCurrentUserSession();
-
- // Plain ROLE_USER may only fetch groups they belong to; not config
super-users.
- if (userSession != null && userSession.getLoginId() != null &&
userSession.isSingleRoleUserSession()) {
- VXUser loggedInVXUser =
xUserService.getXUserByUserName(userSession.getLoginId());
- boolean isMatch = false;
-
- if (loggedInVXUser != null && vXGroup != null) {
- List<XXGroup> userGroups =
xGroupService.getGroupsByUserId(loggedInVXUser.getId());
-
- for (XXGroup xXGroup : userGroups) {
- if (xXGroup != null &&
StringUtils.equals(xXGroup.getName(), vXGroup.getName())) {
- isMatch = true;
- break;
- }
- }
- }
-
- if (!isMatch) {
- vXGroup = null;
- }
- }
-
- return vXGroup;
+ Long id = vXGroup.getId();
Review Comment:
what is the behavior if a non-admin(user role) user is accessing a group
when he is part of the group and when he is not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
