[jira] [Commented] (KYLIN-2938) Project Update ACL issue

2017-10-13 Thread Billy Liu (JIRA)

[ 
https://issues.apache.org/jira/browse/KYLIN-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16203305#comment-16203305
 ] 

Billy Liu commented on KYLIN-2938:
--

Agree. They should be the same permission. 

> Project Update ACL issue
> 
>
> Key: KYLIN-2938
> URL: https://issues.apache.org/jira/browse/KYLIN-2938
> Project: Kylin
>  Issue Type: Bug
>  Components: REST Service
>Affects Versions: v2.1.0
>Reporter: Pan, Julian
>Assignee: Zhong,Jason
>
> I noticed there different security between updateProject and renameProject in 
> ProjectService.
> @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or 
> hasPermission(#currentProject, 'ADMINISTRATION') or 
> hasPermission(#currentProject, 'MANAGEMENT')")
> updateProject
>  @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or 
> hasPermission(#currentProject, 'ADMINISTRATION')")
> renameProject
> Even updateProject will call renameProject. Which will throws exception if 
> user is MANAGEMENT role.
> The renameProject should be same security check with updateProject.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)


[jira] [Commented] (KYLIN-2938) Project Update ACL issue

2017-10-13 Thread Billy Liu (JIRA)

[ 
https://issues.apache.org/jira/browse/KYLIN-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16203311#comment-16203311
 ] 

Billy Liu commented on KYLIN-2938:
--

Patch is welcomed. 

> Project Update ACL issue
> 
>
> Key: KYLIN-2938
> URL: https://issues.apache.org/jira/browse/KYLIN-2938
> Project: Kylin
>  Issue Type: Bug
>  Components: REST Service
>Affects Versions: v2.1.0
>Reporter: Pan, Julian
>Assignee: Zhong,Jason
>
> I noticed there different security between updateProject and renameProject in 
> ProjectService.
> @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or 
> hasPermission(#currentProject, 'ADMINISTRATION') or 
> hasPermission(#currentProject, 'MANAGEMENT')")
> updateProject
>  @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or 
> hasPermission(#currentProject, 'ADMINISTRATION')")
> renameProject
> Even updateProject will call renameProject. Which will throws exception if 
> user is MANAGEMENT role.
> The renameProject should be same security check with updateProject.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)