[
https://issues.apache.org/jira/browse/KYLIN-6119?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
liyang closed KYLIN-6119.
-------------------------
> Potential unauthorized maintenance operation issue
> --------------------------------------------------
>
> Key: KYLIN-6119
> URL: https://issues.apache.org/jira/browse/KYLIN-6119
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Assignee: liyang
> Priority: Major
> Fix For: 5.0.5
>
>
> Several internal maintenance operations exposed on the API port do not
> require administrator authorization. A caller can trigger an event-log
> rollup, a metadata reload, routine cleanup work, and diagnostic-progress
> updates. Some of these operations are reachable without authentication, and
> others require only an authenticated identity rather than an administrator.
> Fix direction: require either an authenticated global administrator or a
> valid internal service credential on these maintenance operations, and have
> the internal maintenance callers present the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
