[DRILL-6690] Non-admin users can access threads page using restAPI

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.14.0
• Component/s: Security
• Assignee: Unassigned
• Reporter: Krystal
• Created: 15/Aug/18 21:19
• Updated: 15/Aug/18 21:31

Description

Through restapi, non-admin users can access drill threads data:

curl -b ~/.drill_cookies -k -H "Content-Type: application/json"  -X GET  https://10.10.10.000:8047/status/threads
"Reference Handler" id=2 state=WAITING
    - waiting on <0x15c20b08> (a java.lang.ref.Reference$Lock)
    - locked <0x15c20b08> (a java.lang.ref.Reference$Lock)
    at java.lang.Object.wait(Native Method)
    at java.lang.Object.wait(Object.java:502)
    at java.lang.ref.Reference.tryHandlePending(Reference.java:191)
    at java.lang.ref.Reference$ReferenceHandler.run(Reference.java:153)