From 5b60c4fad8d37a23992cfb72fb021913387f3cd7 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Tue, 19 May 2020 15:08:44 +0800 Subject: [PATCH] fix: policy create fail on initialization phrase --- pkg/cloudcommon/db/sharablebase.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkg/cloudcommon/db/sharablebase.go b/pkg/cloudcommon/db/sharablebase.go index e7213633a0..8f6ad26f5c 100644 --- a/pkg/cloudcommon/db/sharablebase.go +++ b/pkg/cloudcommon/db/sharablebase.go @@ -168,6 +168,7 @@ func SharableManagerValidateCreateData( // backward compatible, if only is_public is true, make it share to system input.IsPublic = &isPublic input.PublicScope = string(rbacutils.ScopeSystem) + reqScope = rbacutils.ScopeSystem } else { input.IsPublic = nil input.PublicScope = string(rbacutils.ScopeNone) @@ -180,6 +181,7 @@ func SharableManagerValidateCreateData( // backward compatible, if only is_public is true, make it share to system input.IsPublic = &isPublic input.PublicScope = string(rbacutils.ScopeSystem) + reqScope = rbacutils.ScopeSystem } else { input.IsPublic = nil input.PublicScope = string(rbacutils.ScopeNone) @@ -187,9 +189,11 @@ func SharableManagerValidateCreateData( default: return input, errors.Wrap(httperrors.ErrInputParameter, "the resource is not sharable") } - allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "public") - if reqScope.HigherThan(allowScope) { - return input, errors.Wrapf(httperrors.ErrNotSufficientPrivilege, "require %s allow %s", reqScope, allowScope) + if input.IsPublic != nil && *input.IsPublic { + allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "public") + if reqScope.HigherThan(allowScope) { + return input, errors.Wrapf(httperrors.ErrNotSufficientPrivilege, "require %s allow %s", reqScope, allowScope) + } } return input, nil }