github-actions[bot] commented on code in PR #69623:
URL: https://github.com/apache/doris/pull/69623#discussion_r4377457929
##########
fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java:
##########
@@ -1850,6 +1867,7 @@ private void loadTxn2PCImpl(TLoadTxn2PCRequest request)
throws UserException {
if (transactionState == null) {
throw new UserException("transaction [" + request.getTxnId() + "]
not found");
}
+ checkTransactionUser(currentUser, transactionState);
Review Comment:
[P2] Apply the owner check to the parallel cancel-by-label API
The new owner guard is only reached by `loadTxn2PCImpl`. After Alice
prepares an ordinary Stream Load 2PC transaction, a non-ADMIN Bob with
database-level LOAD can instead POST `/api/db/_cancel?label=<AliceLabel>` with
his own credentials. `CancelLoadAction` authenticates him and checks DB LOAD,
then calls `abortTransaction(dbId, label, ...)` without inspecting `txnUser`.
The classic manager resolves the latest label and permits PRECOMMITTED ->
ABORTED; the cloud manager sends a label abort to Meta Service, which also
accepts PRECOMMITTED without a creator check. Alice's newly owned transaction
is therefore still abortable by another load user in both modes. This is a
separate ordinary-load cancellation route, independent of the excluded SQL HTTP
producer. Apply the same creator/ADMIN policy to that external route, preserve
its LOAD and legacy checks, and add a two-user POST-cancel case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
