[
https://issues.apache.org/jira/browse/SPARK-6846?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14543970#comment-14543970
]
Dev Lakhani commented on SPARK-6846:
------------------------------------
As a more complex solution would it be possible to have a unique stage id and
use that in the URL?
http://localhost:4040/stages/kill/?id=0&stage-id=<UNIQUE-STAGE-ID>&terminate=true
A simple auto complete of a previous kill command in chrome followed by an
enter can kill hours worth of work done. Or any other ideas?
> Stage kill URL easy to accidentally trigger and possibility for security
> issue.
> -------------------------------------------------------------------------------
>
> Key: SPARK-6846
> URL: https://issues.apache.org/jira/browse/SPARK-6846
> Project: Spark
> Issue Type: Improvement
> Components: Web UI
> Affects Versions: 1.3.0
> Reporter: Dev Lakhani
> Assignee: Sean Owen
> Priority: Minor
> Fix For: 1.4.0
>
>
> On a similar note: When the kill link is cached in the browser bar, it's easy
> to accidentally kill a job just by pressing enter. For example:
> You press the kill stage button and get the prompt whether you want to kill
> the stage. You launch a new job and start typing:
> http://localhost:4040/
> Chrome for example starts auto completing with
> http://localhost:4040/stages/kill/?id=0&terminate=true
> If you accidentally press enter it will kill the current stage without any
> prompts.
> I think its also a bit of a security issue if from any host you can
> curl/wget/issue: http://localhost:4040/stages/kill/?id=0&terminate=true and
> it will kill the current stage without prompting.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@spark.apache.org
For additional commands, e-mail: issues-h...@spark.apache.org
