liyang created KYLIN-6121:
-----------------------------
Summary: Potential cross-project deletion issue in async query
results
Key: KYLIN-6121
URL: https://issues.apache.org/jira/browse/KYLIN-6121
Project: Kylin
Issue Type: Bug
Reporter: Li Yang
The node-local asynchronous query result cleanup operation can be invoked
through an authenticated API path without an administrator or internal
service-token check. Any authenticated user can remove stored asynchronous
query results for every project handled by that node.
Fix direction: require a global administrator or valid internal service
credential on the node-local cleanup endpoint, and have the legitimate internal
fan-out caller present that credential.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
