krishnamuttevi commented on code in PR #993:
URL: https://github.com/apache/ranger/pull/993#discussion_r3534172012
##########
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java:
##########
@@ -855,30 +854,8 @@ public VXUser getXUserByUserName(@Context
HttpServletRequest request, @PathParam
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" +
RangerAPIList.GET_X_GROUP_BY_GROUP_NAME + "\")")
public VXGroup getXGroupByGroupName(@Context HttpServletRequest request,
@PathParam("groupName") String groupName) {
VXGroup vXGroup =
xGroupService.getGroupByGroupName(groupName);
- UserSessionBase userSession = ContextUtil.getCurrentUserSession();
-
- // Plain ROLE_USER may only fetch groups they belong to; not config
super-users.
- if (userSession != null && userSession.getLoginId() != null &&
userSession.isSingleRoleUserSession()) {
- VXUser loggedInVXUser =
xUserService.getXUserByUserName(userSession.getLoginId());
- boolean isMatch = false;
-
- if (loggedInVXUser != null && vXGroup != null) {
- List<XXGroup> userGroups =
xGroupService.getGroupsByUserId(loggedInVXUser.getId());
-
- for (XXGroup xXGroup : userGroups) {
- if (xXGroup != null &&
StringUtils.equals(xXGroup.getName(), vXGroup.getName())) {
- isMatch = true;
- break;
- }
- }
- }
-
- if (!isMatch) {
- vXGroup = null;
- }
- }
-
- return vXGroup;
+ Long id = vXGroup.getId();
Review Comment:
here if it is a non admin role - (auditor, keyadmin)
passes both masked and exception
but if non admin role - (user) + non group member - it gives 403 forbidden
and non admin role - (user) + group member - it gives vxgroup with masked
updated by field
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
