[
https://issues.apache.org/jira/browse/KYLIN-6121?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
liyang reassigned KYLIN-6121:
-----------------------------
Component/s: Query Engine
Fix Version/s: 5.0.6
Affects Version/s: 5.0.5
Assignee: liyang
> Potential cross-project deletion issue in async query results
> -------------------------------------------------------------
>
> Key: KYLIN-6121
> URL: https://issues.apache.org/jira/browse/KYLIN-6121
> Project: Kylin
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 5.0.5
> Reporter: Li Yang
> Assignee: liyang
> Priority: Major
> Fix For: 5.0.6
>
>
> The node-local asynchronous query result cleanup operation can be invoked
> through an authenticated API path without an administrator or internal
> service-token check. Any authenticated user can remove stored asynchronous
> query results for every project handled by that node.
> Fix direction: require a global administrator or valid internal service
> credential on the node-local cleanup endpoint, and have the legitimate
> internal fan-out caller present that credential.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
