Repository: nifi Updated Branches: refs/heads/master 6874a5d82 -> f3387426a
NIFI-2587: - Adding additional authorization for accessing component property history. Project: http://git-wip-us.apache.org/repos/asf/nifi/repo Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/f3387426 Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/f3387426 Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/f3387426 Branch: refs/heads/master Commit: f3387426a097f0e853f898c91ec379278642f6d6 Parents: 6874a5d Author: Matt Gilman <[email protected]> Authored: Thu Aug 18 10:15:23 2016 -0400 Committer: Mark Payne <[email protected]> Committed: Thu Aug 18 17:05:32 2016 -0400 ---------------------------------------------------------------------- .../org/apache/nifi/web/api/FlowResource.java | 39 ++++++++++++++++++-- 1 file changed, 36 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/nifi/blob/f3387426/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java ---------------------------------------------------------------------- diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java index f3c98d9..06470c4 100644 --- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java +++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java @@ -44,6 +44,7 @@ import org.apache.nifi.groups.ProcessGroup; import org.apache.nifi.util.NiFiProperties; import org.apache.nifi.web.IllegalClusterResourceRequestException; import org.apache.nifi.web.NiFiServiceFacade; +import org.apache.nifi.web.ResourceNotFoundException; import org.apache.nifi.web.Revision; import org.apache.nifi.web.api.dto.AboutDTO; import org.apache.nifi.web.api.dto.BannerDTO; @@ -2056,11 +2057,12 @@ public class FlowResource extends ApplicationResource { @Produces(MediaType.APPLICATION_JSON) @Path("history/components/{componentId}") @ApiOperation( - value = "Gets configuration history for a processor", + value = "Gets configuration history for a component", notes = NON_GUARANTEED_ENDPOINT, response = ComponentHistoryEntity.class, authorizations = { - @Authorization(value = "Read - /flow", type = "") + @Authorization(value = "Read - /flow", type = ""), + @Authorization(value = "Read underlying component - /{component-type}/{uuid}", type = "") } ) @ApiResponses( @@ -2079,7 +2081,38 @@ public class FlowResource extends ApplicationResource { ) @PathParam("componentId") final String componentId) { - authorizeFlow(); + serviceFacade.authorizeAccess(lookup -> { + final NiFiUser user = NiFiUserUtils.getNiFiUser(); + + // authorize the flow + authorizeFlow(); + + try { + final Authorizable authorizable = lookup.getProcessor(componentId).getAuthorizable(); + authorizable.authorize(authorizer, RequestAction.READ, user); + return; + } catch (final ResourceNotFoundException e) { + // ignore as the component may not be a processor + } + + try { + final Authorizable authorizable = lookup.getControllerService(componentId).getAuthorizable(); + authorizable.authorize(authorizer, RequestAction.READ, user); + return; + } catch (final ResourceNotFoundException e) { + // ignore as the component may not be a controller service + } + + try { + final Authorizable authorizable = lookup.getReportingTask(componentId).getAuthorizable(); + authorizable.authorize(authorizer, RequestAction.READ, user); + return; + } catch (final ResourceNotFoundException e) { + // ignore as the component may not be a reporting task + } + + throw new ResourceNotFoundException(String.format("Unable to find component with id '%s'.", componentId)); + }); // Note: History requests are not replicated throughout the cluster and are instead handled by the nodes independently
