[ZEPPELIN-3397] User with read only access can update the permissions of a notebook and gain write access

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 0.7.3
• Component/s: security

Environment

Linux: Centos 7.2 

HDP: 2.6.3 

Zeppelin: 0.7.3 

• Assignee: Unassigned
• Reporter: Ying Chen
• Created: 09/Apr/18 19:11
• Updated: 10/Apr/18 14:32
• Resolved: 10/Apr/18 14:32

Description

NOTE:  Less of an issue if we prevent user from accessing some of the UI....   https://issues.apache.org/jira/browse/ZEPPELIN-3396   (Tho I think the curl endpoints may also need to be updated) 

 

Currently I have a notebook in which is own by the admin, in which user1 has "Read" access.

 As user1,  I can click on "Note permissions" and display the permissions.

 

I then proceed to modify it and save it . 

 

Then as user1,  I can actually go edit the paragraphs and run it after my permission has been updated.