From a826ed2c1a797396ec71ddabe914fabafd77e977 Mon Sep 17 00:00:00 2001 From: Gallardot Date: Mon, 14 Aug 2023 18:28:11 +0800 Subject: [PATCH] [Improvement][security] get-user-info API endpoint should not return the user's password in MD5 format (#14680) * [Improvement][security] get-user-info API endpoint should not return the user's password in MD5 format Signed-off-by: Gallardot * [Improvement][security] list-paging API endpoint should not return the user's password in MD5 format Signed-off-by: Gallardot --------- Signed-off-by: Gallardot Co-authored-by: Aaron Wang --- .../dolphinscheduler/api/service/impl/UsersServiceImpl.java | 3 +++ .../org/apache/dolphinscheduler/dao/mapper/UserMapper.xml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java index 9baf454c14..91a5a78afc 100644 --- a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java +++ b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java @@ -1086,6 +1086,9 @@ public class UsersServiceImpl extends BaseServiceImpl implements UsersService { user.setTimeZone(TimeZone.getDefault().toZoneId().getId()); } + // remove password + user.setUserPassword(null); + result.put(Constants.DATA_LIST, user); putMsg(result, Status.SUCCESS); diff --git a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml index 719e9c59df..ef8b1ce2a2 100644 --- a/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml +++ b/dolphinscheduler-dao/src/main/resources/org/apache/dolphinscheduler/dao/mapper/UserMapper.xml @@ -48,7 +48,7 @@ where user_name=#{userName} and user_password = #{password}