You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Kishor Gollapalliwar <ki...@gmail.com> on 2025/07/22 06:29:29 UTC
Re: Review Request 75320: RANGER-5074: keyadmin user is able to get admin user logs
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/75320/#review227354
-----------------------------------------------------------
Ship it!
Ship It!
- Kishor Gollapalliwar
On April 28, 2025, 3:16 p.m., Rakesh Gupta wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/75320/
> -----------------------------------------------------------
>
> (Updated April 28, 2025, 3:16 p.m.)
>
>
> Review request for ranger, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, sanket shelar, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-5074
> https://issues.apache.org/jira/browse/RANGER-5074
>
>
> Repository: ranger
>
>
> Description
> -------
>
> The Keyadmin user is able to retrieve admin user logs through the following REST APIs:
>
> /service/xaudit/trx_log
> /service/xaudit/trx_log/{id}
> /service/assets/report
> /service/assets/report/{transactionId}
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/service/RangerServiceServiceBase.java 98857638e
> security-admin/src/main/java/org/apache/ranger/service/RangerTrxLogV2Service.java 46c59ef45
>
>
> Diff: https://reviews.apache.org/r/75320/diff/3/
>
>
> Testing
> -------
>
> Tested and verified that the Keyadmin user is unable to retrieve Admin user logs when attempting to access the following REST APIs:
>
> /service/xaudit/trx_log
> /service/xaudit/trx_log/{id}
> /service/assets/report
> /service/assets/report/{transactionId}
>
>
> Thanks,
>
> Rakesh Gupta
>
>