ソースを参照

HUE-4943 [fb] Error trace when trying to download files that are missing perms

Jenny Kim 9 年 前
コミット
da52675

+ 11 - 2
apps/filebrowser/src/filebrowser/views.py

@@ -140,10 +140,19 @@ def download(request, path):
     size = stats['size']
     if not was_modified_since(request.META.get('HTTP_IF_MODIFIED_SINCE'), mtime, size):
         return HttpResponseNotModified()
-        # TODO(philip): Ideally a with statement would protect from leaks,
-    # but tricky to do here.
+        # TODO(philip): Ideally a with statement would protect from leaks, but tricky to do here.
     fh = request.fs.open(path)
 
+    # Verify read permissions on file first
+    try:
+        request.fs.read(path, offset=0, length=1)
+    except WebHdfsException, e:
+        if e.code == 403:
+            raise PopupException(_('User %s is not authorized to download file at path "%s"') %
+                                 (request.user.username, path))
+        else:
+            raise PopupException(_('Failed to download file at path "%s": %s') % (path, e))
+
     response = HttpResponse(_file_reader(fh), content_type=content_type)
     response["Last-Modified"] = http_date(stats['mtime'])
     response["Content-Length"] = stats['size']

+ 8 - 0
apps/filebrowser/src/filebrowser/views_test.py

@@ -809,6 +809,14 @@ alert("XSS")
     assert_equal(200, response.status_code)
     assert_equal('attachment', response['Content-Disposition'])
 
+    # Download fails and displays exception because of missing permissions
+    self.cluster.fs.chmod(prefix + '/xss', 0700)
+
+    not_me = make_logged_in_client("not_me", is_superuser=False)
+    grant_access("not_me", "not_me", "filebrowser")
+    response = not_me.get('/filebrowser/download=%s/xss?disposition=inline' % prefix, follow=True)
+    assert_true('User not_me is not authorized to download' in response.context['message'], response.context['message'])
+
 
   def test_edit_i18n(self):
     prefix = self.cluster.fs_prefix + '/test_view_gz'