Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make sure you can only see your own long-running job list #5435

Merged
merged 2 commits into from
Apr 29, 2021
Merged

Make sure you can only see your own long-running job list #5435

merged 2 commits into from
Apr 29, 2021

Conversation

fm3
Copy link
Member

@fm3 fm3 commented Apr 29, 2021 •
edited
Loading

The jobsController didn’t override findAll, and the generic one from the superclass does not use the access query.

Steps to test:

  • set up long running jobs, run some
  • set up second account
  • each should see only their own long-running jobs in the list

@fm3 fm3 self-assigned this Apr 29, 2021
@fm3 fm3 requested a review from youri-k April 29, 2021 12:37
youri-k
youri-k approved these changes Apr 29, 2021
View reviewed changes
Copy link
Contributor

@youri-k youri-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM :shipit:

@fm3 fm3 merged commit 248d936 into master Apr 29, 2021
@fm3 fm3 deleted the jobs-access-query branch April 29, 2021 14:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@youri-k youri-k youri-k approved these changes

Assignees

@fm3 fm3

Labels
backend bug security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@fm3 @youri-k