Bugfix: Plugins endpoint was unauthenticated (#14570)

The plugins endpoint missed auth check (cherry picked from commit 0a969db)
apache · Apr 15, 2021 · d6aa666 · d6aa666
1 parent a156053
commit d6aa666
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/airflow/www/views.py b/airflow/www/views.py
@@ -2969,6 +2969,11 @@ class PluginView(AirflowBaseView):
     ]
 
     @expose('/plugin')
+    @auth.has_access(
+        [
+            (permissions.ACTION_CAN_READ, permissions.RESOURCE_PLUGIN),
+        ]
+    )
     def list(self):
         """List loaded plugins."""
         plugins_manager.ensure_plugins_loaded()

diff --git a/tests/www/test_views.py b/tests/www/test_views.py
@@ -361,6 +361,12 @@ def test_should_list_entrypoint_plugins_on_page_with_details(self):
         self.check_content_in_response("source", resp)
         self.check_content_in_response("<em>test-entrypoint-testpluginview==1.0.0:</em> <Mock id=", resp)
 
+    def test_endpoint_should_not_be_unauthenticated(self):
+        self.logout()
+        resp = self.client.get('/plugin', follow_redirects=True)
+        self.check_content_not_in_response("test_plugin", resp)
+        self.check_content_in_response("Sign In", resp)
+
 
 class TestPoolModelView(TestBase):
     def setUp(self):