[
https://issues.apache.org/jira/browse/ATLAS-5372?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
chaitali borole updated ATLAS-5372:
-----------------------------------
Fix Version/s: 3.0.0
2.6.0
> Prevent cross-user overwrite in saved search create API via caller-supplied
> guid
> --------------------------------------------------------------------------------
>
> Key: ATLAS-5372
> URL: https://issues.apache.org/jira/browse/ATLAS-5372
> Project: Atlas
> Issue Type: Improvement
> Reporter: chaitali borole
> Assignee: chaitali borole
> Priority: Major
> Fix For: 3.0.0, 2.6.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> *PreRequisites*
> Two authenticated users with permissions to use saved-search APIs (for
> example: userA, userB).
> *Steps*
> Login as userA and create a saved search using:
> POST /api/atlas/v2/search/saved
> capture the returned guid (call it G1).
> Login as userB and send another create request to:
> POST /api/atlas/v2/search/saved
> include:
> ownerName = userB
> guid = G1
> different name / searchParameters.
> *Fetch saved searches for both users:*
> GET /api/atlas/v2/search/saved?user=userB
> GET /api/atlas/v2/search/saved?user=userA
> *Observed Result*
> The object with guid = G1 now appears under userB with updated content.
> userA no longer has that saved search entry with G1.
> *Expected Result*
> Create API should not allow client-supplied guid to update an existing
> saved-search object owned by another user.
> POST create should either reject non-empty guid or ignore it and always
> create a new object
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
