Re: [PR] NIFI-12862 FlowAnalysisResults should not leak anauthorized component details [nifi]

2024-03-05 Thread via GitHub
sardell commented on PR #8475: URL: https://github.com/apache/nifi/pull/8475#issuecomment-1979517205 @tpalfy My mistake. I missed the subjectPermission property in the already-implemented response. Disregard. -- This is an automated message from the Apache Git Service. To respond to the

Re: [PR] NIFI-12862 FlowAnalysisResults should not leak anauthorized component details [nifi]

2024-03-05 Thread via GitHub
tpalfy commented on PR #8475: URL: https://github.com/apache/nifi/pull/8475#issuecomment-1979418892 > @tpalfy Thanks for the quick turnaround. How would the client know if a user has read access permission to a component? By checking all those field returns on each violation and implicitly

Re: [PR] NIFI-12862 FlowAnalysisResults should not leak anauthorized component details [nifi]

2024-03-05 Thread via GitHub
sardell commented on PR #8475: URL: https://github.com/apache/nifi/pull/8475#issuecomment-1979342161 @tpalfy Thanks for the quick turnaround. How would the client know if a user has read access permission to a component? By checking all those field returns on each violation and implicitly

[PR] NIFI-12862 FlowAnalysisResults should not leak anauthorized component details [nifi]

2024-03-05 Thread via GitHub
tpalfy opened a new pull request, #8475: URL: https://github.com/apache/nifi/pull/8475 When building FlowAnalysisRuleViolationDTO objects (in StandardNiFiServiceFacade), violating component details will be left blank when user has no read permission for that component.