Description
Currently, prepareBulkLoad and cleanupBulkLoad are using "hasSomeAccess", which performs scan on ACL table, instead of using TableAuthManager. Also, the method "hasSomeAccess" has a logical error, as it doesn't filter the acl scan results by the current active user. More specifically
for (UserPermission userPerm: perms) { for (Action userAction: userPerm.getActions()) { if (userAction.equals(action)) { return AuthResult.allow(method, "Access allowed", requestUser, action, tableName, null, null); } } }
The if clause ideally should be having something like userPerm.getUser.equals(requestUser). This issue will help us in getting rid of this problematic implementation.