Browse Source

[security] List tables with doas option

Do not restrict user list to user belonging to the same groups
as the current user.
Romain Rigaux 11 năm trước cách đây
mục cha
commit
fc58f59

+ 8 - 7
apps/beeswax/src/beeswax/api.py

@@ -19,14 +19,15 @@ import json
 import logging
 import re
 
+from django.contrib.auth.models import User
 from django.core.urlresolvers import reverse
 from django.http import HttpResponse, Http404
 from django.utils.translation import ugettext as _
 
 from thrift.transport.TTransport import TTransportException
-
 from desktop.context_processors import get_app_name
-
+from desktop.lib.i18n import force_unicode
+from desktop.lib.exceptions_renderable import PopupException
 from jobsub.parameterization import substitute_variables
 
 import beeswax.models
@@ -35,13 +36,10 @@ from beeswax.forms import QueryForm
 from beeswax.data_export import upload
 from beeswax.design import HQLdesign
 from beeswax.server import dbms
-from beeswax.server.dbms import expand_exception, get_query_server_config,\
-  QueryServerException
+from beeswax.server.dbms import expand_exception, get_query_server_config, QueryServerException
 from beeswax.views import authorized_get_design, authorized_get_query_history, make_parameterization_form,\
                           safe_get_design, save_design, massage_columns_for_json, _get_query_handle_and_state,\
                           _parse_out_hadoop_jobs
-from desktop.lib.i18n import force_unicode
-from desktop.lib.exceptions_renderable import PopupException
 
 
 LOG = logging.getLogger(__name__)
@@ -83,7 +81,10 @@ def error_handler(view_fn):
 def autocomplete(request, database=None, table=None):
   app_name = get_app_name(request)
   query_server = get_query_server_config(app_name)
-  db = dbms.get(request.user, query_server)
+  do_as = request.user
+  if request.user.is_superuser and 'doas' in request.GET:
+    do_as = User.object.get(username=request.GET.get('doas'))
+  db = dbms.get(do_as, query_server)
   response = {}
 
   try:

+ 1 - 1
apps/security/src/security/templates/hive.mako

@@ -48,7 +48,7 @@ ${ layout.menubar(section='hive') }
             </br>
             <input type="checkbox" checked="checked"> ${_('Me')}
             </br>          
-            <select data-bind="options: availableHadoopUsers" size="10"></select>
+            <select data-bind="options: availableHadoopUsers, value: doAs" size="10"></select>
           </li>
           <li class="nav-header"><i class="fa fa-group"></i> ${ _('Groups') }
             </br>

+ 7 - 1
apps/security/static/js/hive.ko.js

@@ -166,6 +166,10 @@ var HiveViewModel = function (initial) {
   self.role = new Role(self);
   self.privilege = new Privilege(self, {});
 
+  self.doAs = ko.observable('');
+  self.doAs.subscribe(function() {
+	self.assist.fetchDatabases();
+  });
   self.availableHadoopUsers = ko.observableArray();
   self.availableHadoopGroups = ko.observableArray();
 
@@ -235,7 +239,9 @@ var HiveViewModel = function (initial) {
   };
   
   self.fetchUsers = function () {
-    $.getJSON('/desktop/api/users/autocomplete', function (data) {
+    $.getJSON('/desktop/api/users/autocomplete', {
+      
+    }, function (data) {
       $.each(data.users, function (i, user) {
         self.availableHadoopUsers.push(user.username);
       });

+ 1 - 3
apps/useradmin/src/useradmin/views.py

@@ -74,11 +74,9 @@ def list_permissions(request):
 
 
 def list_for_autocomplete(request):
-  # Restrict to what the current user can interact with reverse('desktop.views.home')
   if request.ajax:
-    user_groups = request.user.groups.all()
     response = {
-      'users': massage_users_for_json(User.objects.filter(groups__in=user_groups).exclude(pk=request.user.pk)),
+      'users': massage_users_for_json(User.objects.exclude(pk=request.user.pk)),
       'groups': massage_groups_for_json(Group.objects.all())
     }
     return HttpResponse(json.dumps(response), mimetype="application/json")