Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XXL-JOB 2.4.1 Permission Issue: Ordinary Users Can Indirectly Execute Tasks of Unassigned Executors via Sub-Task IDs #3516

Open
skyblue955 opened this issue Jul 23, 2024 · 0 comments

Comments

@skyblue955
Copy link

XXL-JOB Version: 2.4.1

Expected Behavior:
Users should only be able to see and execute tasks on the executors they are assigned to.
Ordinary users should not be able to see or execute tasks on executors they are not assigned to.

Actual Behavior:
In version 2.4.1, even though an ordinary user is not assigned to executor B, they can still indirectly execute tasks on executor B by creating a task on executor A and using the sub-task ID (which is a task from executor B).

Steps to Reproduce the Behavior:

  1. Ensure the version of XXL-JOB is 2.4.1 or lower.
  2. Create two executors, labeled as A and B.
    image
  3. Create an ordinary user and assign executor A to this user.
    image
  4. Use the administrator account to create a task on executor B, note the task ID as 2.
    image
    image
  5. Log in with the ordinary user account and confirm that executor B and the task with ID 2 are not visible.
  6. Create a new task on executor A and add the sub-task ID in the advanced configuration, set it to 2.
    image
  7. Execute the task created by the ordinary user on executor A and observe that the task with ID 2 on executor B is also executed
    image
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant