You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by ma...@apache.org on 2016/08/18 21:05:55 UTC
nifi git commit: NIFI-2587: - Adding additional authorization for
accessing component property history.
Repository: nifi
Updated Branches:
refs/heads/master 6874a5d82 -> f3387426a
NIFI-2587:
- Adding additional authorization for accessing component property history.
Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/f3387426
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/f3387426
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/f3387426
Branch: refs/heads/master
Commit: f3387426a097f0e853f898c91ec379278642f6d6
Parents: 6874a5d
Author: Matt Gilman <ma...@gmail.com>
Authored: Thu Aug 18 10:15:23 2016 -0400
Committer: Mark Payne <ma...@hotmail.com>
Committed: Thu Aug 18 17:05:32 2016 -0400
----------------------------------------------------------------------
.../org/apache/nifi/web/api/FlowResource.java | 39 ++++++++++++++++++--
1 file changed, 36 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/nifi/blob/f3387426/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
----------------------------------------------------------------------
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
index f3c98d9..06470c4 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/FlowResource.java
@@ -44,6 +44,7 @@ import org.apache.nifi.groups.ProcessGroup;
import org.apache.nifi.util.NiFiProperties;
import org.apache.nifi.web.IllegalClusterResourceRequestException;
import org.apache.nifi.web.NiFiServiceFacade;
+import org.apache.nifi.web.ResourceNotFoundException;
import org.apache.nifi.web.Revision;
import org.apache.nifi.web.api.dto.AboutDTO;
import org.apache.nifi.web.api.dto.BannerDTO;
@@ -2056,11 +2057,12 @@ public class FlowResource extends ApplicationResource {
@Produces(MediaType.APPLICATION_JSON)
@Path("history/components/{componentId}")
@ApiOperation(
- value = "Gets configuration history for a processor",
+ value = "Gets configuration history for a component",
notes = NON_GUARANTEED_ENDPOINT,
response = ComponentHistoryEntity.class,
authorizations = {
- @Authorization(value = "Read - /flow", type = "")
+ @Authorization(value = "Read - /flow", type = ""),
+ @Authorization(value = "Read underlying component - /{component-type}/{uuid}", type = "")
}
)
@ApiResponses(
@@ -2079,7 +2081,38 @@ public class FlowResource extends ApplicationResource {
)
@PathParam("componentId") final String componentId) {
- authorizeFlow();
+ serviceFacade.authorizeAccess(lookup -> {
+ final NiFiUser user = NiFiUserUtils.getNiFiUser();
+
+ // authorize the flow
+ authorizeFlow();
+
+ try {
+ final Authorizable authorizable = lookup.getProcessor(componentId).getAuthorizable();
+ authorizable.authorize(authorizer, RequestAction.READ, user);
+ return;
+ } catch (final ResourceNotFoundException e) {
+ // ignore as the component may not be a processor
+ }
+
+ try {
+ final Authorizable authorizable = lookup.getControllerService(componentId).getAuthorizable();
+ authorizable.authorize(authorizer, RequestAction.READ, user);
+ return;
+ } catch (final ResourceNotFoundException e) {
+ // ignore as the component may not be a controller service
+ }
+
+ try {
+ final Authorizable authorizable = lookup.getReportingTask(componentId).getAuthorizable();
+ authorizable.authorize(authorizer, RequestAction.READ, user);
+ return;
+ } catch (final ResourceNotFoundException e) {
+ // ignore as the component may not be a reporting task
+ }
+
+ throw new ResourceNotFoundException(String.format("Unable to find component with id '%s'.", componentId));
+ });
// Note: History requests are not replicated throughout the cluster and are instead handled by the nodes independently