[#QB-3532] Builds steps are visible via REST API even if user doesn't have permissions to do it

QuickBuild

Builds steps are visible via REST API even if user doesn't have permissions to do it

Created: 07/Apr/20 02:52 PM Updated: 09/May/20 12:06 AM

Component/s:

None

Affects Version/s:

None

Fix Version/s:

10.0.13

Original Estimate:

Unknown

Remaining Estimate:

Unknown

Time Spent:

Unknown

Description

« Hide

Example: https://build.pmease.com/rest/builds/4555/

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Robin Shen [07/Apr/20 11:39 PM]

This is by design. As long as user is authorized with configuration access permission, the user can access step information of the build. Also user is allowed to view step status of the build from UI.

[ Permlink | « Hide ]

Jedrzej Buraczewski [27/Apr/20 03:18 PM]

Hi Robin,
User is not able to see steps (with step names, build machines, duration) via GUI, only using REST.

https://build.pmease.com/build/4555/step_status - doesn't work while anonymous.
https://build.pmease.com/rest/builds/4555 - I see all steps like:
<entry>
<string>master>publish binary</string>
<com.pmease.quickbuild.stepsupport.StepRuntime>
<beginTime>1533175619961</beginTime>
<status>SUCCESSFUL</status>
<nodeAddress>star.pmease.com:8810</nodeAddress>
<resources/>
<waitDuration>1</waitDuration>
<duration>4364</duration>
</com.pmease.quickbuild.stepsupport.StepRuntime>
</entry>

Are you sure this is correct behaviour?

[ Permlink | « Hide ]

Robin Shen [27/Apr/20 11:42 PM]

Yes you are right, UI and rest api are inconsistent in this regard. We will remove step status information from returned build object in this case.