influxdata / influxdata/influxdb

Should user with ReadData permission be allowed to execute SHOW RETENTION POLICIES statement

Open
#9,735 4 comments 0 reactions 2 assignees Claimed by @samhld View on GitHub
1.x area/auth pm/review
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

The documentation (https://docs.influxdata.com/enterprise_influxdb/v1.5/features/users/#cluster-user-information)states that user with ReadData permission only can execute 'show field key', 'show measurements', 'show series', 'show tag key' and 'show tag value' statements. The same information is mentioned in chronograf's documentation. At the same time user with the ReadData permission is able to execute 'SHOW RETENTION POLICIES ON ' statements as long as he has 'READ' permission for the database.
It would seem correct such a behavior since user has a read permission on database, he should be able to get all kinds of information about the db.
This is question for PM: Do we update the docs or fix the bug

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.