[jira] [Commented] (KYLIN-2938) Project Update ACL issue
[ https://issues.apache.org/jira/browse/KYLIN-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16203305#comment-16203305 ] Billy Liu commented on KYLIN-2938: -- Agree. They should be the same permission. > Project Update ACL issue > > > Key: KYLIN-2938 > URL: https://issues.apache.org/jira/browse/KYLIN-2938 > Project: Kylin > Issue Type: Bug > Components: REST Service >Affects Versions: v2.1.0 >Reporter: Pan, Julian >Assignee: Zhong,Jason > > I noticed there different security between updateProject and renameProject in > ProjectService. > @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or > hasPermission(#currentProject, 'ADMINISTRATION') or > hasPermission(#currentProject, 'MANAGEMENT')") > updateProject > @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or > hasPermission(#currentProject, 'ADMINISTRATION')") > renameProject > Even updateProject will call renameProject. Which will throws exception if > user is MANAGEMENT role. > The renameProject should be same security check with updateProject. -- This message was sent by Atlassian JIRA (v6.4.14#64029)
[jira] [Commented] (KYLIN-2938) Project Update ACL issue
[ https://issues.apache.org/jira/browse/KYLIN-2938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16203311#comment-16203311 ] Billy Liu commented on KYLIN-2938: -- Patch is welcomed. > Project Update ACL issue > > > Key: KYLIN-2938 > URL: https://issues.apache.org/jira/browse/KYLIN-2938 > Project: Kylin > Issue Type: Bug > Components: REST Service >Affects Versions: v2.1.0 >Reporter: Pan, Julian >Assignee: Zhong,Jason > > I noticed there different security between updateProject and renameProject in > ProjectService. > @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or > hasPermission(#currentProject, 'ADMINISTRATION') or > hasPermission(#currentProject, 'MANAGEMENT')") > updateProject > @PreAuthorize(Constant.ACCESS_HAS_ROLE_ADMIN + " or > hasPermission(#currentProject, 'ADMINISTRATION')") > renameProject > Even updateProject will call renameProject. Which will throws exception if > user is MANAGEMENT role. > The renameProject should be same security check with updateProject. -- This message was sent by Atlassian JIRA (v6.4.14#64029)