瀏覽代碼

[security] List tables with doas option

Do not restrict user list to user belonging to the same groups
as the current user.
Romain Rigaux 11 年之前
父節點
當前提交
fc58f593d6

+ 8 - 7
apps/beeswax/src/beeswax/api.py

@@ -19,14 +19,15 @@ import json
 import logging
 import re
 
+from django.contrib.auth.models import User
 from django.core.urlresolvers import reverse
 from django.http import HttpResponse, Http404
 from django.utils.translation import ugettext as _
 
 from thrift.transport.TTransport import TTransportException
-
 from desktop.context_processors import get_app_name
-
+from desktop.lib.i18n import force_unicode
+from desktop.lib.exceptions_renderable import PopupException
 from jobsub.parameterization import substitute_variables
 
 import beeswax.models
@@ -35,13 +36,10 @@ from beeswax.forms import QueryForm
 from beeswax.data_export import upload
 from beeswax.design import HQLdesign
 from beeswax.server import dbms
-from beeswax.server.dbms import expand_exception, get_query_server_config,\
-  QueryServerException
+from beeswax.server.dbms import expand_exception, get_query_server_config, QueryServerException
 from beeswax.views import authorized_get_design, authorized_get_query_history, make_parameterization_form,\
                           safe_get_design, save_design, massage_columns_for_json, _get_query_handle_and_state,\
                           _parse_out_hadoop_jobs
-from desktop.lib.i18n import force_unicode
-from desktop.lib.exceptions_renderable import PopupException
 
 
 LOG = logging.getLogger(__name__)
@@ -83,7 +81,10 @@ def error_handler(view_fn):
 def autocomplete(request, database=None, table=None):
   app_name = get_app_name(request)
   query_server = get_query_server_config(app_name)
-  db = dbms.get(request.user, query_server)
+  do_as = request.user
+  if request.user.is_superuser and 'doas' in request.GET:
+    do_as = User.object.get(username=request.GET.get('doas'))
+  db = dbms.get(do_as, query_server)
   response = {}
 
   try:

+ 1 - 1
apps/security/src/security/templates/hive.mako

@@ -48,7 +48,7 @@ ${ layout.menubar(section='hive') }
             </br>
             <input type="checkbox" checked="checked"> ${_('Me')}
             </br>          
-            <select data-bind="options: availableHadoopUsers" size="10"></select>
+            <select data-bind="options: availableHadoopUsers, value: doAs" size="10"></select>
           </li>
           <li class="nav-header"><i class="fa fa-group"></i> ${ _('Groups') }
             </br>

+ 7 - 1
apps/security/static/js/hive.ko.js

@@ -166,6 +166,10 @@ var HiveViewModel = function (initial) {
   self.role = new Role(self);
   self.privilege = new Privilege(self, {});
 
+  self.doAs = ko.observable('');
+  self.doAs.subscribe(function() {
+	self.assist.fetchDatabases();
+  });
   self.availableHadoopUsers = ko.observableArray();
   self.availableHadoopGroups = ko.observableArray();
 
@@ -235,7 +239,9 @@ var HiveViewModel = function (initial) {
   };
   
   self.fetchUsers = function () {
-    $.getJSON('/desktop/api/users/autocomplete', function (data) {
+    $.getJSON('/desktop/api/users/autocomplete', {
+      
+    }, function (data) {
       $.each(data.users, function (i, user) {
         self.availableHadoopUsers.push(user.username);
       });

+ 1 - 3
apps/useradmin/src/useradmin/views.py

@@ -74,11 +74,9 @@ def list_permissions(request):
 
 
 def list_for_autocomplete(request):
-  # Restrict to what the current user can interact with reverse('desktop.views.home')
   if request.ajax:
-    user_groups = request.user.groups.all()
     response = {
-      'users': massage_users_for_json(User.objects.filter(groups__in=user_groups).exclude(pk=request.user.pk)),
+      'users': massage_users_for_json(User.objects.exclude(pk=request.user.pk)),
       'groups': massage_groups_for_json(Group.objects.all())
     }
     return HttpResponse(json.dumps(response), mimetype="application/json")