opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-19 10:46:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: policy allow if one of the matching rules is allow

Browse Source
This commit is contained in:
Qiu Jian
2020-06-16 23:06:30 +08:00
parent 818d40c08b
commit 2efb7fc9e6
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/policy/policy.go
+9 -2
View File
@@ -403,8 +403,15 @@ func (manager *SPolicyManager) allowWithoutCache(scope rbacutils.TRbacScope, use
var result rbacutils.TRbacResult
if len(matchRules) > 0 {
rule := rbacutils.GetMatchRule(matchRules, service, resource, action, extra...)
result = rule.Result
result = rbacutils.Deny
for _, rule := range matchRules {
if rule.Result == rbacutils.Allow {
result = rbacutils.Allow
break
}
}
// rule := rbacutils.GetMatchRule(matchRules, service, resource, action, extra...)
// result = rule.Result
} else if findMatchPolicy {
// if find matched policy, but no rule matching, allow anyway
result = rbacutils.Allow