[ZEPPELIN-2167] User with insufficient privileges can still restore files by renaming files in/out of Trash

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 0.7.1, 0.8.0
• Component/s: security
• Assignee: Prabhjyot Singh
• Reporter: Deepesh Khandelwal
• Created: 24/Feb/17 07:40
• Updated: 04/Mar/17 04:09
• Resolved: 04/Mar/17 04:08

Description

Steps to reproduce:

1. Create a notebook "test_nb" as bob.
2. Delete the notebook
3. Login as mary and try restoring "test_nb" from Trash folder. The system correctly complains of insufficient privileges.
4. Open the "test_nb" notebook from Trash folder. The notebook opens with title "~Trash/test_nb".
5. Edit the title and remove the prefix "~Trash".
   If you now look at the list of notebooks there is no file "test_nb" in Trash.
   Interestingly when you try and delete the recently moved file from Trash it complains that mary does not have privileges to delete it. Edit the title of that notebook to "~Trash/test_nb" and it goes back to Trash folder.

Issue Links

• links to: GitHub Pull Request #2086