influxdata / influxdata/influxdb
Should user with ReadData permission be allowed to execute SHOW RETENTION POLICIES statement
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
The documentation (https://docs.influxdata.com/enterprise_influxdb/v1.5/features/users/#cluster-user-information)states that user with ReadData permission only can execute 'show field key', 'show measurements', 'show series', 'show tag key' and 'show tag value' statements. The same information is mentioned in chronograf's documentation. At the same time user with the ReadData permission is able to execute 'SHOW RETENTION POLICIES ON ' statements as long as he has 'READ' permission for the database.
It would seem correct such a behavior since user has a read permission on database, he should be able to get all kinds of information about the db.
This is question for PM: Do we update the docs or fix the bug
Contributor guide
Assessment
This issue has not been assessed yet.