opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-21 14:19:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

修正：普通用户无法访问admin权限的资源

Browse Source
This commit is contained in:
Qiu Jian
2018-11-14 22:30:17 +08:00
parent f72ee1063f
commit 0ed39ff2c9
3 changed files with 31 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/rbac.go
+14 -14
View File
@@ -54,14 +54,14 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
} else {
requireAdmin = true
}
if !requireAdmin {
result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
if result == rbacutils.Allow || result == rbacutils.OwnerAllow {
return true
}
// if !requireAdmin {
result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow) {
return true
}
result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
// }
result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
return result == rbacutils.Allow
}
@@ -85,14 +85,14 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
requireAdmin = true
}
if !requireAdmin {
result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
if result == rbacutils.Allow || (result == rbacutils.OwnerAllow && isOwner) {
return true
}
//if !requireAdmin {
result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow && isOwner) {
return true
}
result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
//}
result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
return result == rbacutils.Allow
}
pkg/cloudcommon/policy/policy.go
+3 -5
View File
@@ -52,12 +52,12 @@ func parseJsonPolicy(obj jsonutils.JSONObject) (string, rbacutils.SRbacPolicy, e
return "", policy, err
}
blobStr, err := obj.GetString("blob")
blobStr, err := obj.GetString("policy")
if err != nil {
log.Errorf("get blob error %s", err)
return "", policy, err
}
blob, err := jsonutils.ParseString(blobStr)
blob, err := jsonutils.ParseYAML(blobStr)
if err != nil {
log.Errorf("parse blob json error %s", err)
return "", policy, err
@@ -77,14 +77,12 @@ func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRb
policies := make(map[string]rbacutils.SRbacPolicy)
adminPolicies := make(map[string]rbacutils.SRbacPolicy)
modules.Policies.SetEnableFilter(false)
offset := 0
for {
params := jsonutils.NewDict()
params.Add(jsonutils.NewInt(2048), "limit")
params.Add(jsonutils.NewInt(int64(offset)), "offset")
result, err := modules.Policies.ResourceManager.List(s, params)
result, err := modules.Policies.List(s, params)
if err != nil {
log.Errorf("fetch policy failed")