dengzhhu653 commented on code in PR #6829:
URL: https://github.com/apache/hive/pull/6829#discussion_r4332209882
##########
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/HMSHandler.java:
##########
@@ -4196,9 +4200,12 @@ public List<WriteEventInfo>
get_all_write_event_info(GetAllWriteEventInfoRequest
startFunction("get_all_write_event_info");
Exception ex = null;
try {
+ authorizeProxyPrivilege();
List<WriteEventInfo> writeEventInfoList =
getMS().getAllWriteEventInfo(request.getTxnId(),
request.getDbName(), request.getTableName());
- return writeEventInfoList == null ? Collections.emptyList() :
writeEventInfoList;
+ List<WriteEventInfo> filtered =
FilterUtils.filterWriteEventInfoIfEnabled(
Review Comment:
Similar to `get_next_notification`, I think `authorizeProxyPrivilege()` is
enough for this API, this prevents the API from being accessed by any other
authenticated user, usually the user allowed is the operator or admin, we
should let it see the full result(notifications) instead of give the access to
all tables in order to get the notification, and the notification itself is
less important than the table.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
