[ZEPPELIN-3350] Don't allow set cronExecutionUser#2914
Conversation
|
@prabhjyotsingh @felixcheung Could you help review this ? Thanks |
felixcheung
left a comment
There was a problem hiding this comment.
since it was there before, should we have some UI or documentation on why it is gone?
|
|
||
| /** | ||
| * Run all paragraphs sequentially. | ||
| * Run all paragraphs sequentially. Only used for CronJob |
There was a problem hiding this comment.
is it hard to enforce that only CronJob is calling this?
does it matter - maybe not, now that we are not impersonating any user
There was a problem hiding this comment.
Currently it is only called by cron. I plan to improve it in 0.9, this is only quick bug fix for 0.8 release.
|
Doc is added |
### What is this PR for? This PR just does a quick fix this security issue. 1. Remove the setting cron user in frontend 2. Run the note via owner. ### What type of PR is it? [Bug Fix ] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3350 ### How should this be tested? * Manually tested ### Screenshots (if appropriate)  ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes #2914 from zjffdu/ZEPPELIN-3350 and squashes the following commits: 63325d0 [Jeff Zhang] [ZEPPELIN-3350] Don't allow set cronExecutionUser (cherry picked from commit 08c9ad9) Signed-off-by: Jeff Zhang <zjffdu@apache.org>
|
@zjffdu are you sure this works when logged out? i followed the call stack and I'm wondering if there would happen NPE if no AuthenticationInfo is present:
|
|
@weand Do you see any issue when logged out ? |
|
not directly when logged out. instead the NPE happens when Zeppelin gets restartet and next cron runs before the note was run manually, which is a frequent use case IMHO.
|
|
Thanks @weand I have created ZEPPELIN-3404 for it |
1 similar comment
|
Thanks @weand I have created ZEPPELIN-3404 for it |
### What is this PR for? This PR just does a quick fix this security issue. 1. Remove the setting cron user in frontend 2. Run the note via owner. ### What type of PR is it? [Bug Fix ] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3350 ### How should this be tested? * Manually tested ### Screenshots (if appropriate)  ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2914 from zjffdu/ZEPPELIN-3350 and squashes the following commits: 63325d0 [Jeff Zhang] [ZEPPELIN-3350] Don't allow set cronExecutionUser
### What is this PR for? This PR just does a quick fix this security issue. 1. Remove the setting cron user in frontend 2. Run the note via owner. ### What type of PR is it? [Bug Fix ] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3350 ### How should this be tested? * Manually tested ### Screenshots (if appropriate)  ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2914 from zjffdu/ZEPPELIN-3350 and squashes the following commits: 63325d0 [Jeff Zhang] [ZEPPELIN-3350] Don't allow set cronExecutionUser
…before cronjob ### What is this PR for? This bug is introduced by #2914, this PR will set authenticationInfo using its user as we will store user into note.json. ### What type of PR is it? [Bug Fix] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3404 ### How should this be tested? * Manually tested ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes #2925 from zjffdu/ZEPPELIN-3404 and squashes the following commits: b94ecc9 [Jeff Zhang] ZEPPELIN-3404. Fail to run cronjob when user doesn't run it manually before cronjob (cherry picked from commit 1cea92c) Signed-off-by: Jeff Zhang <zjffdu@apache.org>
…before cronjob ### What is this PR for? This bug is introduced by #2914, this PR will set authenticationInfo using its user as we will store user into note.json. ### What type of PR is it? [Bug Fix] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3404 ### How should this be tested? * Manually tested ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes #2925 from zjffdu/ZEPPELIN-3404 and squashes the following commits: b94ecc9 [Jeff Zhang] ZEPPELIN-3404. Fail to run cronjob when user doesn't run it manually before cronjob
This PR just does a quick fix this security issue. 1. Remove the setting cron user in frontend 2. Run the note via owner. [Bug Fix ] * [ ] - Task * https://issues.apache.org/jira/browse/ZEPPELIN-3350 * Manually tested  * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2914 from zjffdu/ZEPPELIN-3350 and squashes the following commits: 63325d0 [Jeff Zhang] [ZEPPELIN-3350] Don't allow set cronExecutionUser (cherry picked from commit 08c9ad9) Signed-off-by: Jeff Zhang <zjffdu@apache.org> (cherry picked from commit 8528261) Change-Id: I9ba82bfd36a6bb1968e244503be808375c7071bf
…before cronjob This bug is introduced by apache#2914, this PR will set authenticationInfo using its user as we will store user into note.json. [Bug Fix] * [ ] - Task * https://issues.apache.org/jira/browse/ZEPPELIN-3404 * Manually tested * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2925 from zjffdu/ZEPPELIN-3404 and squashes the following commits: b94ecc9 [Jeff Zhang] ZEPPELIN-3404. Fail to run cronjob when user doesn't run it manually before cronjob (cherry picked from commit 1cea92c) Signed-off-by: Jeff Zhang <zjffdu@apache.org> (cherry picked from commit eb7969b) Change-Id: I7c747eaefcc2d7234d0cf07aeaeb26b72c26ee43
…before cronjob ### What is this PR for? This bug is introduced by apache#2914, this PR will set authenticationInfo using its user as we will store user into note.json. ### What type of PR is it? [Bug Fix] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3404 ### How should this be tested? * Manually tested ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2925 from zjffdu/ZEPPELIN-3404 and squashes the following commits: b94ecc9 [Jeff Zhang] ZEPPELIN-3404. Fail to run cronjob when user doesn't run it manually before cronjob
…before cronjob ### What is this PR for? This bug is introduced by apache#2914, this PR will set authenticationInfo using its user as we will store user into note.json. ### What type of PR is it? [Bug Fix] ### Todos * [ ] - Task ### What is the Jira issue? * https://issues.apache.org/jira/browse/ZEPPELIN-3404 ### How should this be tested? * Manually tested ### Questions: * Does the licenses files need update? No * Is there breaking changes for older versions? No * Does this needs documentation? No Author: Jeff Zhang <zjffdu@apache.org> Closes apache#2925 from zjffdu/ZEPPELIN-3404 and squashes the following commits: b94ecc9 [Jeff Zhang] ZEPPELIN-3404. Fail to run cronjob when user doesn't run it manually before cronjob (cherry picked from commit 1cea92c) Signed-off-by: Jeff Zhang <zjffdu@apache.org>
What is this PR for?
This PR just does a quick fix this security issue.
What type of PR is it?
[Bug Fix ]
Todos
What is the Jira issue?
How should this be tested?
Screenshots (if appropriate)
Questions: