liyang created KYLIN-6119:
-----------------------------
Summary: Potential unauthorized maintenance operation issue
Key: KYLIN-6119
URL: https://issues.apache.org/jira/browse/KYLIN-6119
Project: Kylin
Issue Type: Bug
Reporter: liyang
Several internal maintenance operations exposed on the API port do not require
administrator authorization. A caller can trigger an event-log rollup, a
metadata reload, routine cleanup work, and diagnostic-progress updates. Some of
these operations are reachable without authentication, and others require only
an authenticated identity rather than an administrator.
Fix direction: require either an authenticated global administrator or a valid
internal service credential on these maintenance operations, and have the
internal maintenance callers present the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
