This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new 9d454173f6f branch-4.1: [fix](config) Restrict frontend config updates
to root in cloud mode #66478 (#66647)
9d454173f6f is described below
commit 9d454173f6f891aa74060ac1572f890af7d299c8
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Aug 11 18:40:28 2026 +0800
branch-4.1: [fix](config) Restrict frontend config updates to root in cloud
mode #66478 (#66647)
Cherry-picked from #66478
Co-authored-by: Gavin Chou <[email protected]>
---
.../commands/AdminSetFrontendConfigCommand.java | 8 +++++++
.../AdminSetFrontendConfigCommandTest.java | 27 ++++++++++++++++++++++
2 files changed, 35 insertions(+)
diff --git
a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
index f967d28e2d9..e215fe56b3f 100644
---
a/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
+++
b/fe/fe-core/src/main/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommand.java
@@ -20,10 +20,13 @@ package org.apache.doris.nereids.trees.plans.commands;
import org.apache.doris.analysis.RedirectStatus;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.AnalysisException;
+import org.apache.doris.common.Config;
import org.apache.doris.common.ConfigBase;
+import org.apache.doris.common.DdlException;
import org.apache.doris.common.ErrorCode;
import org.apache.doris.common.ErrorReport;
import org.apache.doris.common.UserException;
+import org.apache.doris.mysql.privilege.Auth;
import org.apache.doris.mysql.privilege.PrivPredicate;
import org.apache.doris.nereids.trees.plans.PlanType;
import org.apache.doris.nereids.trees.plans.visitor.PlanVisitor;
@@ -92,6 +95,11 @@ public class AdminSetFrontendConfigCommand extends Command
implements Redirect {
if (type != NodeType.FRONTEND) {
throw new AnalysisException("Only support setting Frontend configs
now");
}
+
+ if (Config.isCloudMode()
+ &&
!ConnectContext.get().getCurrentUserIdentity().getUser().equals(Auth.ROOT_USER))
{
+ throw new DdlException("Unsupported operation");
+ }
}
@Override
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
index 54e47ac0540..a6231a05b6b 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/plans/commands/AdminSetFrontendConfigCommandTest.java
@@ -18,6 +18,7 @@
package org.apache.doris.nereids.trees.plans.commands;
import org.apache.doris.analysis.RedirectStatus;
+import org.apache.doris.analysis.UserIdentity;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.AnalysisException;
import org.apache.doris.common.CaseSensibility;
@@ -46,6 +47,32 @@ public class AdminSetFrontendConfigCommandTest extends
TestWithFeService {
.startsWith("ADMIN SET FRONTEND CONFIG"));
}
+ @Test
+ public void testCloudAdminCannotSetFrontendConfig() {
+ String originalDeployMode = Config.deploy_mode;
+ String originalCloudUniqueId = Config.cloud_unique_id;
+ boolean originalEnableUdfInLoad = Config.enable_udf_in_load;
+ UserIdentity originalUserIdentity =
connectContext.getCurrentUserIdentity();
+ try {
+ Config.deploy_mode = "cloud";
+ Config.cloud_unique_id = "";
+ connectContext.setCurrentUserIdentity(UserIdentity.ADMIN);
+
+ IllegalStateException exception =
Assertions.assertThrows(IllegalStateException.class,
+ () -> executeSql("admin set frontend
config(\"enable_udf_in_load\" = \"true\");"));
+ Assertions.assertEquals("errCode = 2, detailMessage = Unsupported
operation", exception.getMessage());
+
+ connectContext.setCurrentUserIdentity(UserIdentity.ROOT);
+ Assertions.assertDoesNotThrow(
+ () -> executeSql("admin set frontend
config(\"enable_udf_in_load\" = \"true\");"));
+ } finally {
+ connectContext.setCurrentUserIdentity(originalUserIdentity);
+ Config.deploy_mode = originalDeployMode;
+ Config.cloud_unique_id = originalCloudUniqueId;
+ Config.enable_udf_in_load = originalEnableUdfInLoad;
+ }
+ }
+
@Test
public void testRedirectStatus() {
String sql = "admin set frontend config(\"alter_table_timeout_second\"
= \"60\");";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
