Эх сурвалжийг харах

HUE-9397 [core] Have the sharing related APIs serve a 403 if document sharing is disabled for non-admins

Johan Ahlen 5 жил өмнө
parent
commit
e56ec82de3

+ 7 - 2
apps/useradmin/src/useradmin/views.py

@@ -44,11 +44,11 @@ from django.utils.translation import get_language, ugettext as _
 
 import desktop.conf
 from desktop.auth.backend import is_admin
-from desktop.conf import LDAP, ENABLE_ORGANIZATIONS, ENABLE_CONNECTORS
+from desktop.conf import LDAP, ENABLE_ORGANIZATIONS, ENABLE_CONNECTORS, ENABLE_SHARING
 from desktop.lib.django_util import JsonResponse, render
 from desktop.lib.exceptions_renderable import PopupException
 from desktop.models import _get_apps
-from desktop.views import antixss
+from desktop.views import antixss, serve_403_error
 from hadoop.fs.exceptions import WebHdfsException
 
 from useradmin import ldap_access
@@ -130,6 +130,8 @@ def list_for_autocomplete(request):
     groups = Group.objects.filter(name__icontains=autocomplete_filter).order_by('name')
     if request.GET.get('only_mygroups'):
       groups = request.user.groups.filter(name__icontains=autocomplete_filter).order_by('name')
+  elif not ENABLE_SHARING.get():
+    return serve_403_error(request)
   else:
     usergroups = request.user.groups.all()
     # Get all users in the usergroups he belongs to and then filter by username
@@ -154,6 +156,9 @@ def list_for_autocomplete(request):
 
 
 def get_users_by_id(request):
+  if not is_admin(request.user) and not ENABLE_SHARING.get():
+    return serve_403_error(request)
+
   userids = json.loads(request.GET.get('userids', "[]"))
   userids = userids[:100]
   users = User.objects.filter(id__in=userids).order_by('email' if ENABLE_ORGANIZATIONS.get() else 'username')

+ 9 - 1
desktop/core/src/desktop/api2.py

@@ -45,7 +45,7 @@ from useradmin.models import User, Group
 
 from desktop import appmanager
 from desktop.auth.backend import is_admin
-from desktop.conf import ENABLE_CONNECTORS, ENABLE_GIST_PREVIEW, get_clusters, IS_K8S_ONLY
+from desktop.conf import ENABLE_CONNECTORS, ENABLE_GIST_PREVIEW, get_clusters, IS_K8S_ONLY, ENABLE_SHARING
 from desktop.lib.conf import BoundContainer, GLOBAL_CONFIG, is_anonymous
 from desktop.lib.django_util import JsonResponse, login_notrequired, render
 from desktop.lib.exceptions_renderable import PopupException
@@ -54,6 +54,7 @@ from desktop.lib.i18n import smart_str, force_unicode
 from desktop.lib.paths import get_desktop_root
 from desktop.models import Document2, Document, Directory, FilesystemException, uuid_default, \
   UserPreferences, get_user_preferences, set_user_preferences, get_cluster_config, __paginate, _get_gist_document
+from desktop.views import serve_403_error
 
 if sys.version_info[0] > 2:
   from io import StringIO as string_io
@@ -83,6 +84,7 @@ def api_error_handler(func):
 @api_error_handler
 def get_config(request):
   config = get_cluster_config(request.user)
+  config['hue_config']['is_admin'] = is_admin(request.user);
   config['clusters'] = list(get_clusters(request.user).values())
   config['documents'] = {
     'types': list(Document2.objects.documents(user=request.user).order_by().values_list('type', flat=True).distinct())
@@ -677,6 +679,9 @@ def share_document(request):
 
   Example of input: {'read': {'user_ids': [1, 2, 3], 'group_ids': [1, 2, 3]}}
   """
+  if not is_admin(request.user) and not ENABLE_SHARING.get():
+    return serve_403_error(request)
+
   uuid = request.POST.get('uuid')
   perms_dict = request.POST.get('data')
 
@@ -716,6 +721,9 @@ def share_document_link(request):
 
   Example of input: {"uuid": "xxxx", "perm": "read" / "write" / "off"}
   """
+  if not is_admin(request.user) and not ENABLE_SHARING.get():
+    return serve_403_error(request)
+
   uuid = request.POST.get('uuid')
   perm = request.POST.get('perm')
 

+ 5 - 2
desktop/core/src/desktop/models.py

@@ -50,7 +50,7 @@ from useradmin.organization import _fitered_queryset
 from desktop import appmanager
 from desktop.auth.backend import is_admin
 from desktop.conf import get_clusters, CLUSTER_ID, IS_MULTICLUSTER_ONLY, IS_K8S_ONLY, ENABLE_ORGANIZATIONS, ENABLE_PROMETHEUS,\
-    has_connectors, TASK_SERVER, ENABLE_GIST, APP_BLACKLIST
+    has_connectors, TASK_SERVER, ENABLE_GIST, APP_BLACKLIST, ENABLE_SHARING
 from desktop.lib import fsmanager
 from desktop.lib.connectors.api import _get_installed_connectors
 from desktop.lib.connectors.models import Connector
@@ -1721,7 +1721,10 @@ class ClusterConfig(object):
       ],
       'default_sql_interpreter': default_sql_interpreter,
       'cluster_type': self.cluster_type,
-      'has_computes': self.cluster_type in ('altus', 'snowball') # or any grouped engine connectors
+      'has_computes': self.cluster_type in ('altus', 'snowball'), # or any grouped engine connectors
+      'hue_config': {
+        'enable_sharing': ENABLE_SHARING.get()
+      }
     }