[jira] [Resolved] (SPARK-6846) Stage kill URL easy to accidentally trigger and possibility for security issue.

["Sean Owen (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SPARK-6846?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sean Owen resolved SPARK-6846.
------------------------------
       Resolution: Fixed
    Fix Version/s: 1.4.0
         Assignee: Sean Owen

Resolved by https://github.com/apache/spark/pull/5528

> Stage kill URL easy to accidentally trigger and possibility for security issue.
> -------------------------------------------------------------------------------
>
>                 Key: SPARK-6846
>                 URL: https://issues.apache.org/jira/browse/SPARK-6846
>             Project: Spark
>          Issue Type: Improvement
>          Components: Web UI
>    Affects Versions: 1.3.0
>            Reporter: Dev Lakhani
>            Assignee: Sean Owen
>            Priority: Minor
>             Fix For: 1.4.0
>
>
> On a similar note: When the kill link is cached in the browser bar, it's easy to accidentally kill a job just by pressing enter. For example:
> You press the kill stage button and get the prompt whether you want to kill the stage. You launch a new job and start typing:
> http://localhost:4040/
> Chrome for example starts auto completing with http://localhost:4040/stages/kill/?id=0&terminate=true 
> If you accidentally press enter it will kill the current stage without any prompts.
> I think its also a bit of a security issue if from any host you can curl/wget/issue: http://localhost:4040/stages/kill/?id=0&terminate=true and it will kill the current stage without prompting.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org