Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG]the permission to read resource status is incorrect #2190

Open
h4ofanya opened this issue Jun 20, 2024 · 0 comments
Open

[BUG]the permission to read resource status is incorrect #2190

h4ofanya opened this issue Jun 20, 2024 · 0 comments

Comments

@h4ofanya
Copy link
Contributor

Describe the bug

even if the user is not one of the roles of the tenant, the corresponding tenant information can be read

To Reproduce

curl -X POST -u 'root:' 'http:https://127.0.0.1:8902/api/v1/sql?db=public' -d "create tenant tenant_delay with drop_after='7'"
curl -X POST -u 'root:' 'http:https://127.0.0.1:8902/api/v1/sql?db=public' -d "drop tenant tenant_delay"
curl -X POST -u 'root:' 'http:https://127.0.0.1:8902/api/v1/sql?db=public' -d 'create tenant if not exists test_rs_tenant1;'
curl -X POST -u 'root:' 'http:https://127.0.0.1:8902/api/v1/sql?db=public' -d 'create user if not exists test_rs_u1;'
curl -X POST -u 'root:' 'http:https://127.0.0.1:8902/api/v1/sql?db=public' -d 'alter tenant test_rs_tenant1 add user test_rs_u1 as owner'

curl -X POST -u 'test_rs_u1:' 'http:https://127.0.0.1:8902/api/v1/sql?tenant=test_rs_tenant1&db=public' -d 'select * from information_schema.resource_status'
time,name,action,try_count,status,comment
2024-06-25 07:39:09,tenant_delay,DropTenant,0,Schedule,

Expected behavior

No response

Additional context

No response

@h4ofanya h4ofanya changed the title the permission to read resource status is incorrect [BUG]the permission to read resource status is incorrect Jun 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant