opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-21 06:09:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6451 from swordqiu/hotfix/qj-ini-policy-create-fail

Browse Source 
fix: policy create fail on initialization phrase
This commit is contained in:
Zexi Li
2020-05-19 15:48:17 +08:00
committed by GitHub
parent 1bb2ef919c 5b60c4fad8
commit 2a06b9f24c
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/sharablebase.go
+7 -3
View File
@@ -168,6 +168,7 @@ func SharableManagerValidateCreateData(
// backward compatible, if only is_public is true, make it share to system
input.IsPublic = &isPublic
input.PublicScope = string(rbacutils.ScopeSystem)
reqScope = rbacutils.ScopeSystem
} else {
input.IsPublic = nil
input.PublicScope = string(rbacutils.ScopeNone)
@@ -180,6 +181,7 @@ func SharableManagerValidateCreateData(
// backward compatible, if only is_public is true, make it share to system
input.IsPublic = &isPublic
input.PublicScope = string(rbacutils.ScopeSystem)
reqScope = rbacutils.ScopeSystem
} else {
input.IsPublic = nil
input.PublicScope = string(rbacutils.ScopeNone)
@@ -187,9 +189,11 @@ func SharableManagerValidateCreateData(
default:
return input, errors.Wrap(httperrors.ErrInputParameter, "the resource is not sharable")
}
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "public")
if reqScope.HigherThan(allowScope) {
return input, errors.Wrapf(httperrors.ErrNotSufficientPrivilege, "require %s allow %s", reqScope, allowScope)
if input.IsPublic != nil && *input.IsPublic {
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "public")
if reqScope.HigherThan(allowScope) {
return input, errors.Wrapf(httperrors.ErrNotSufficientPrivilege, "require %s allow %s", reqScope, allowScope)
}
}
return input, nil
}