[
https://issues.apache.org/jira/browse/HIVE-17701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16194053#comment-16194053
]
Tao Li commented on HIVE-17701:
-------------------------------
Potentially we can move hasAdministratorAccess all to the beginning of "Active
session" section and remove the call for the following sections. Thus it should
fail early in the session section and return the error page at that time.
However the advantage of the uploaded patch is, if we change the logic of
hasAdministratorAccess in future such that we just return false (when
permission check fails) without returning error page, then we can skip
rendering of the 3 sections. That logic is more clear.
> Added restriction to historic queries on web UI
> -----------------------------------------------
>
> Key: HIVE-17701
> URL: https://issues.apache.org/jira/browse/HIVE-17701
> Project: Hive
> Issue Type: Bug
> Components: HiveServer2
> Reporter: Thejas M Nair
> Assignee: Tao Li
> Attachments: HIVE-17701.1.patch, HIVE-17701.2.patch
>
>
> The HiveServer2 Web UI (HIVE-12550) shows recently completed queries.
> However, a user can see the queries run by other users as well, and that is a
> security/privacy concern.
> Only admin users should be allowed to see queries from other users (similar
> to behavior of display for configs, stack trace etc).
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
