[
https://issues.apache.org/jira/browse/ATLAS-5372?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104263#comment-18104263
]
ASF subversion and git services commented on ATLAS-5372:
--------------------------------------------------------
Commit c1cc1ff9114f19248ec642d61eb861a1dab75919 in atlas's branch
refs/heads/master from chaitalicod
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=c1cc1ff91 ]
ATLAS-5372: Prevent cross-user overwrite in saved search create API via
caller-supplied guid (#724)
Co-authored-by: chaitalithombare <[email protected]>
> Prevent cross-user overwrite in saved search create API via caller-supplied
> guid
> --------------------------------------------------------------------------------
>
> Key: ATLAS-5372
> URL: https://issues.apache.org/jira/browse/ATLAS-5372
> Project: Atlas
> Issue Type: Improvement
> Reporter: chaitali borole
> Assignee: chaitali borole
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> *PreRequisites*
> Two authenticated users with permissions to use saved-search APIs (for
> example: userA, userB).
> *Steps*
> Login as userA and create a saved search using:
> POST /api/atlas/v2/search/saved
> capture the returned guid (call it G1).
> Login as userB and send another create request to:
> POST /api/atlas/v2/search/saved
> include:
> ownerName = userB
> guid = G1
> different name / searchParameters.
> *Fetch saved searches for both users:*
> GET /api/atlas/v2/search/saved?user=userB
> GET /api/atlas/v2/search/saved?user=userA
> *Observed Result*
> The object with guid = G1 now appears under userB with updated content.
> userA no longer has that saved search entry with G1.
> *Expected Result*
> Create API should not allow client-supplied guid to update an existing
> saved-search object owned by another user.
> POST create should either reject non-empty guid or ignore it and always
> create a new object
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
