teamclairvoyant / airflow-user-management-plugin Goto Github PK

Hi,

I tried using this plugin and I noticed even when the users are logged out they can access the user management page which shouldn't be an expected behavior when it comes to managing users and in security perspective.

I hope you find this useful for improving this plugin.

Thanks for this plugin!

I changed my password, but show error.

Node: work-pc

Traceback (most recent call last):
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/app.py", line 1988, in wsgi_app
response = self.full_dispatch_request()
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/app.py", line 1641, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/app.py", line 1544, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/_compat.py", line 33, in reraise
raise value
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/app.py", line 1639, in full_dispatch_request
rv = self.dispatch_request()
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask/app.py", line 1625, in dispatch_request
return self.view_functionsrule.endpoint
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask_admin/base.py", line 69, in inner
return self._run_view(f, *args, **kwargs)
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask_admin/base.py", line 368, in _run_view
return fn(self, *args, **kwargs)
File "/home/u01/airflow/env/lib/python3.4/site-packages/flask_admin/model/base.py", line 1974, in edit_view
if self.update_model(form, model):
File "/home/u01/airflow/plugins/airflow-user-management-plugin/plugins/user_management_plugin.py", line 96, in update_model
logging.info("form.password_confirm: " + str(form.password_confirm))
AttributeError: 'PasswordUserForm' object has no attribute 'password_confirm'

i try change code:
user_management_plugin.py
line 96:
# logging.info("form.password_confirm: " + str(form.password_confirm))

Then it runs fine.

As described in the title, we had a user report that he could check the Superuser box in his user management page despite not being a superuser, and saving the changes granted him those permissions.