Horreum
Horreum copied to clipboard
Schema list returns count of all schemas, regardless of visibilty
GET calls to /api/schema
returns a count of number of Schemas for pagination, but does not apply visibility of schemas for current user. This provides an incorrect total number of schemas available for the current user as they do not have access to all schemas in the system
Hm, so I doesn't look like we do any role checking on the query: https://github.com/Hyperfoil/Horreum/blob/master/horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/SchemaServiceImpl.java#L193 Here is what we do for tests: https://github.com/Hyperfoil/Horreum/blob/master/horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/TestServiceImpl.java#L238
In TestServiceImpl we explicitly check for roles, should we do similar for Schma?
Also, it looks like Tests also returns the total amount of tests with using TestDAO.count()
instead of using the size returned by the query that check for roles.
@johnaohara ?
On Hold due to https://github.com/Hyperfoil/Horreum/discussions/1603