Antonenko Alexander created AMBARI-17401:
--------------------------------------------
Summary: Service actions are available via firepath even if not
visible on UI (RBAC)
Key: AMBARI-17401
URL: https://issues.apache.org/jira/browse/AMBARI-17401
Project: Ambari
Issue Type: Bug
Components: ambari-web
Affects Versions: 2.4.0
Reporter: Antonenko Alexander
Assignee: Antonenko Alexander
Fix For: 2.4.0
Login as a service operator. (He is not allowed to move components)
Move to services tab, move to MapReduce service. Now with firepath search for
xpath : //a[text()='Move History Server']. Even though it is not visible, it is
accessible via UI elements. Anyone with this knowledge can run a script to do
move components to different hosts (My selenium test successfully ran for
service operator.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
