liyang created KYLIN-6125:
-----------------------------
Summary: Potential cross-project metadata access issue in internal
tables
Key: KYLIN-6125
URL: https://issues.apache.org/jira/browse/KYLIN-6125
Project: Kylin
Issue Type: Bug
Affects Versions: 5.0.5
Reporter: liyang
Assignee: liyang
Fix For: 5.0.6
Internal-table list and detail read operations accept a project name but do not
enforce project read permission. An authenticated user can retrieve
internal-table schema, partition metadata, storage type, and properties from a
project they cannot access.
Fix direction: enforce project read permission in InternalTableService before
reading internal-table metadata.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
