浏览代码

HUE-6864 [jb] Check for permission before killing a job

Romain Rigaux 8 年之前
父节点
当前提交
4ccf0c1
共有 2 个文件被更改,包括 19 次插入6 次删除
  1. 16 6
      apps/jobbrowser/src/jobbrowser/tests.py
  2. 3 0
      apps/jobbrowser/src/jobbrowser/views.py

+ 16 - 6
apps/jobbrowser/src/jobbrowser/tests.py

@@ -18,7 +18,6 @@
 
 
 import json
 import json
 import logging
 import logging
-import Queue
 import re
 import re
 import time
 import time
 import unittest
 import unittest
@@ -405,6 +404,10 @@ class TestMapReduce2NoHadoop:
     grant_access("test2", "test2", "jobbrowser")
     grant_access("test2", "test2", "jobbrowser")
     self.user2 = User.objects.get(username='test2')
     self.user2 = User.objects.get(username='test2')
 
 
+    self.c3 = make_logged_in_client(is_superuser=False, username="test3")
+    grant_access("test3", "test3", "jobbrowser")
+    self.user3 = User.objects.get(username='test3')
+
     resource_manager_api.get_resource_manager = lambda username: MockResourceManagerApi(username)
     resource_manager_api.get_resource_manager = lambda username: MockResourceManagerApi(username)
     mapreduce_api.get_mapreduce_api = lambda username: MockMapreduceApi(username)
     mapreduce_api.get_mapreduce_api = lambda username: MockMapreduceApi(username)
     history_server_api.get_history_server_api = lambda username: HistoryServerApi(username)
     history_server_api.get_history_server_api = lambda username: HistoryServerApi(username)
@@ -488,12 +491,15 @@ class TestMapReduce2NoHadoop:
     assert_true(can_view_job('test', response.context['job']))
     assert_true(can_view_job('test', response.context['job']))
     assert_true(can_modify_job('test', response.context['job']))
     assert_true(can_modify_job('test', response.context['job']))
 
 
-    response2 = self.c2.get('/jobbrowser/jobs/job_1356251510842_0054')
-    assert_true('don't have permission to access job' in response2.content, response2.content)
-
-    assert_false(can_view_job('test2', response.context['job']))
+    assert_true(can_view_job('test2', response.context['job']))
     assert_false(can_modify_job('test2', response.context['job']))
     assert_false(can_modify_job('test2', response.context['job']))
 
 
+    assert_false(can_view_job('test3', response.context['job']))
+    assert_false(can_modify_job('test3', response.context['job']))
+
+    response2 = self.c3.get('/jobbrowser/jobs/job_1356251510842_0054')
+    assert_true('don't have permission to access job' in response2.content, response2.content)
+
   def test_kill_job(self):
   def test_kill_job(self):
     job_id = 'application_1356251510842_0054'
     job_id = 'application_1356251510842_0054'
     try:
     try:
@@ -502,6 +508,10 @@ class TestMapReduce2NoHadoop:
     finally:
     finally:
       MockResourceManagerApi.APPS[job_id]['state'] = 'RUNNING'
       MockResourceManagerApi.APPS[job_id]['state'] = 'RUNNING'
 
 
+    response = self.c2.post('/jobbrowser/jobs/%s/kill?format=json' % job_id)
+    assert_true('Kill operation is forbidden.' in response.content, response.content)
+
+
 class MockResourceManagerApi:
 class MockResourceManagerApi:
   APPS = {
   APPS = {
     'application_1356251510842_0054': {
     'application_1356251510842_0054': {
@@ -660,7 +670,7 @@ class MockMapreduce2Api(object):
               "value" : "test",
               "value" : "test",
            }, {
            }, {
               "name" : "mapreduce.job.acl-view-job",
               "name" : "mapreduce.job.acl-view-job",
-              "value" : "test",
+              "value" : "test,test2",
            }
            }
          ]
          ]
       }
       }

+ 3 - 0
apps/jobbrowser/src/jobbrowser/views.py

@@ -271,6 +271,9 @@ def kill_job(request, job):
   if request.method != "POST":
   if request.method != "POST":
     raise Exception(_("kill_job may only be invoked with a POST (got a %(method)s).") % {'method': request.method})
     raise Exception(_("kill_job may only be invoked with a POST (got a %(method)s).") % {'method': request.method})
 
 
+  if not can_kill_job(job, request.user):
+    raise PopupException(_("Kill operation is forbidden."))
+
   try:
   try:
     job.kill()
     job.kill()
   except Exception, e:
   except Exception, e: