database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[fix](auth) ordinary users can see the processes of other users (#39747) (#40415)

Browse Source 
pick: https://github.com/apache/doris/pull/39747
This commit is contained in:
zhangdong
2024-09-09 11:13:18 +08:00
committed by GitHub
parent e1e09badfa
commit a3eba2aad5
4 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fe/fe-core/src/main/java/org/apache/doris/qe/ConnectScheduler.java
View File

@ -17,6 +17,7 @@
package org.apache.doris.qe;
import org.apache.doris.analysis.UserIdentity;
import org.apache.doris.catalog.Env;
import org.apache.doris.common.ThreadPoolManager;
import org.apache.doris.common.util.DebugUtil;
@ -173,10 +174,17 @@ public class ConnectScheduler {
}
// used for thrift
public List<List<String>> listConnectionWithoutAuth(boolean isShowFullSql, boolean isShowFeHost) {
public List<List<String>> listConnectionForRpc(UserIdentity userIdentity, boolean isShowFullSql,
boolean isShowFeHost) {
List<List<String>> list = new ArrayList<>();
long nowMs = System.currentTimeMillis();
for (ConnectContext ctx : connectionMap.values()) {
// Check auth
if (!ctx.getCurrentUserIdentity().equals(userIdentity) && !Env.getCurrentEnv()
.getAccessManager()
.checkGlobalPriv(userIdentity, PrivPredicate.GRANT)) {
continue;
}
list.add(ctx.toThreadInfo(isShowFullSql).toRow(-1, nowMs, isShowFeHost));
}
return list;

1
fe/fe-core/src/main/java/org/apache/doris/qe/ShowExecutor.java
View File

@ -483,6 +483,7 @@ public class ShowExecutor {
try {
TShowProcessListRequest request = new TShowProcessListRequest();
request.setShowFullSql(isShowFullSql);
request.setCurrentUserIdent(ConnectContext.get().getCurrentUserIdentity().toThrift());
List<Pair<String, Integer>> frontends = FrontendsProcNode.getFrontendWithRpcPort(Env.getCurrentEnv(),
false);
FrontendService.Client client = null;

6
fe/fe-core/src/main/java/org/apache/doris/service/FrontendServiceImpl.java
View File

@ -4006,8 +4006,12 @@ public class FrontendServiceImpl implements FrontendService.Iface {
if (request.isSetShowFullSql()) {
isShowFullSql = request.isShowFullSql();
}
UserIdentity userIdentity = UserIdentity.ROOT;
if (request.isSetCurrentUserIdent()) {
userIdentity = UserIdentity.fromThrift(request.getCurrentUserIdent());
}
List<List<String>> processList = ExecuteEnv.getInstance().getScheduler()
.listConnectionWithoutAuth(isShowFullSql, true);
.listConnectionForRpc(userIdentity, isShowFullSql, true);
TShowProcessListResult result = new TShowProcessListResult();
result.setProcessList(processList);
return result;