ATLAS-3845 : Audit API returns the audit information for an unauthorised entity

Signed-off-by: Sarath Subramanian <sarath@apache.org>

ATLAS-3845 : Audit API returns the audit information for an unauthorised entity
474d73c5 · chaitali borole · Sarath Subramanian · c8cf4765 · 474d73c5
Commit 474d73c5 authored Jun 22, 2020 by chaitali borole Committed by Sarath Subramanian Jun 22, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

EntityREST.java ...p/src/main/java/org/apache/atlas/web/rest/EntityREST.java +3 -0

No files found.
--- a/webapp/src/main/java/org/apache/atlas/web/rest/EntityREST.java
+++ b/webapp/src/main/java/org/apache/atlas/web/rest/EntityREST.java
@@ -806,6 +806,9 @@ public class EntityREST {
                perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "EntityREST.getAuditEvents(" + guid + ", " + startKey + ", " + count + ")");
            }

+            // following call enforces authorization for entity-read
+            entitiesStore.getHeaderById(guid);
+
            List<EntityAuditEventV2> ret = new ArrayList<>();

            if(auditAction != null) {