Skip to content

Commit 90a9437

Browse files
remove user auth for query in list filters
current: server validates if user is authorized for the streams in the `filter_query` in the filters list change: server lists all available saved filters reason: in saved search, `filter_query` is not a valid sql string it is just a key-value pair also, unauthorized user cannot view the saved filter as he is restricted in the prism UI hence, removed the check
1 parent 2793d81 commit 90a9437

File tree

3 files changed

+10
-27
lines changed

3 files changed

+10
-27
lines changed

src/handlers/http/users/filters.rs

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ use crate::{
2121
parseable::PARSEABLE,
2222
storage::{object_storage::filter_path, ObjectStorageError},
2323
users::filters::{Filter, CURRENT_FILTER_VERSION, FILTERS},
24-
utils::{actix::extract_session_key_from_req, get_hash, get_user_from_request},
24+
utils::{get_hash, get_user_from_request},
2525
};
2626
use actix_web::{
2727
http::header::ContentType,
@@ -33,10 +33,8 @@ use chrono::Utc;
3333
use http::StatusCode;
3434
use serde_json::Error as SerdeError;
3535

36-
pub async fn list(req: HttpRequest) -> Result<impl Responder, FiltersError> {
37-
let key =
38-
extract_session_key_from_req(&req).map_err(|e| FiltersError::Custom(e.to_string()))?;
39-
let filters = FILTERS.list_filters(&key).await;
36+
pub async fn list() -> Result<impl Responder, FiltersError> {
37+
let filters = FILTERS.list_filters().await;
4038
Ok((web::Json(filters), StatusCode::OK))
4139
}
4240

src/prism/home/mod.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ pub async fn generate_home_response(key: &SessionKey) -> Result<HomeResponse, Pr
104104
get_alert_titles(key),
105105
get_correlation_titles(key),
106106
get_dashboard_titles(key),
107-
get_filter_titles(key),
107+
get_filter_titles(),
108108
get_alerts_info()
109109
);
110110

@@ -258,9 +258,9 @@ async fn get_dashboard_titles(key: &SessionKey) -> Result<Vec<TitleAndId>, Prism
258258
Ok(dashboard_titles)
259259
}
260260

261-
async fn get_filter_titles(key: &SessionKey) -> Result<Vec<TitleAndId>, PrismHomeError> {
261+
async fn get_filter_titles() -> Result<Vec<TitleAndId>, PrismHomeError> {
262262
let filter_titles = FILTERS
263-
.list_filters(key)
263+
.list_filters()
264264
.await
265265
.iter()
266266
.map(|filter| TitleAndId {

src/users/filters.rs

Lines changed: 4 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ use tokio::sync::RwLock;
2323

2424
use super::TimeFilter;
2525
use crate::{
26-
alerts::alerts_utils::user_auth_for_query, migration::to_bytes, parseable::PARSEABLE,
27-
rbac::map::SessionKey, storage::object_storage::filter_path, utils::get_hash,
26+
migration::to_bytes, parseable::PARSEABLE, storage::object_storage::filter_path,
27+
utils::get_hash,
2828
};
2929

3030
pub static FILTERS: Lazy<Filters> = Lazy::new(Filters::default);
@@ -152,23 +152,8 @@ impl Filters {
152152
.cloned()
153153
}
154154

155-
pub async fn list_filters(&self, key: &SessionKey) -> Vec<Filter> {
156-
let read = self.0.read().await;
157-
158-
let mut filters = Vec::new();
159-
160-
for f in read.iter() {
161-
let query = if let Some(q) = &f.query.filter_query {
162-
q
163-
} else {
164-
continue;
165-
};
166-
167-
if (user_auth_for_query(key, query).await).is_ok() {
168-
filters.push(f.clone())
169-
}
170-
}
171-
filters
155+
pub async fn list_filters(&self) -> Vec<Filter> {
156+
self.0.read().await.iter().cloned().collect()
172157
}
173158
}
174159

0 commit comments

Comments
 (0)