rzo1 opened a new pull request, #9003: URL: https://github.com/apache/storm/pull/9003
Two problems on `getTopologyHistory`: it performed no authorization check at all, and the identity used for filtering was the caller-supplied `user` argument rather than the authenticated principal. `isAdmin` was computed as `adminUsers.contains(user)`, and the visibility test failed open on `user == null`, so a direct Thrift caller could pass null and receive every assigned topology. `readTopologyHistory` repeated the same fail-open over the on-disk history. The call is now authorized like its neighbours, and the effective user comes from `ReqContext` mapped through the configured `IPrincipalToLocal`. An admin caller may still name a different user, which is how the UI serves `/history/summary` on behalf of its web users. A caller that is not an admin and names somebody else gets its own history back, with a WARN naming the principal and `nimbus.admins`, rather than an error. That keeps the page working on a cluster whose UI principal was left out of `nimbus.admins` (`docs/SECURITY.md` already recommends adding it) instead of failing the request. Extends `NimbusTest`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
