opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-19 02:37:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: 支持过滤有admin_secgrp的虚拟机

Browse Source
This commit is contained in:
Qu Xuan
2019-12-30 10:49:58 +08:00
parent e4abf1b8fe
commit 4a9549a6be
3 changed files with 51 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apis/compute/secgroup.go
+2
View File
@@ -77,6 +77,8 @@ type SSecgroupCreateInput struct {
}
type SSecgroupListFilterInput struct {
apis.BaseListInput
Equals string
Server string
}
pkg/compute/models/guests.go
+28 -8
View File
@@ -42,10 +42,12 @@ import (
imageapi "yunion.io/x/onecloud/pkg/apis/image"
schedapi "yunion.io/x/onecloud/pkg/apis/scheduler"
"yunion.io/x/onecloud/pkg/cloudcommon/cmdline"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/userdata"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
@@ -234,16 +236,34 @@ func (manager *SGuestManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQ
secgrpIds = append(secgrpIds, secgrp.Id)
}
isAdmin := false
admin, _ := query.Bool("admin")
if consts.IsRbacEnabled() {
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
if allowScope == rbacutils.ScopeSystem || allowScope == rbacutils.ScopeDomain {
isAdmin = true
}
} else if userCred.HasSystemAdminPrivilege() && admin {
isAdmin = true
}
filters := []sqlchemy.ICondition{}
if notIn {
filter1 := sqlchemy.NotIn(q.Field("id"),
GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery())
filter2 := sqlchemy.NotIn(q.Field("secgrp_id"), secgrpIds)
q = q.Filter(sqlchemy.AND(filter1, filter2))
filters = append(filters, sqlchemy.NotIn(q.Field("id"),
GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery()))
filters = append(filters, sqlchemy.NotIn(q.Field("secgrp_id"), secgrpIds))
if isAdmin {
filters = append(filters, sqlchemy.NotIn(q.Field("admin_secgrp_id"), secgrpIds))
}
q = q.Filter(sqlchemy.AND(filters...))
} else {
filter1 := sqlchemy.In(q.Field("id"),
GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery())
filter2 := sqlchemy.In(q.Field("secgrp_id"), secgrpIds)
q = q.Filter(sqlchemy.OR(filter1, filter2))
filters = append(filters, sqlchemy.In(q.Field("id"),
GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery()))
filters = append(filters, sqlchemy.In(q.Field("secgrp_id"), secgrpIds))
if isAdmin {
filters = append(filters, sqlchemy.In(q.Field("admin_secgrp_id"), secgrpIds))
}
q = q.Filter(sqlchemy.OR(filters...))
}
}
pkg/compute/models/secgroups.go
+21 -6
View File
@@ -30,10 +30,12 @@ import (
"yunion.io/x/sqlchemy"
api "yunion.io/x/onecloud/pkg/apis/compute"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -112,12 +114,25 @@ func (manager *SSecurityGroupManager) ListItemFilter(ctx context.Context, q *sql
return nil, httperrors.NewGeneralError(err)
}
serverId := guest.GetId()
sq1 := GuestManager.Query("secgrp_id").Equals("id", serverId).SubQuery()
sq2 := GuestsecgroupManager.Query("secgroup_id").Equals("guest_id", serverId).SubQuery()
q = q.Filter(sqlchemy.OR(
sqlchemy.In(q.Field("id"), sq1),
sqlchemy.In(q.Field("id"), sq2),
))
filters := []sqlchemy.ICondition{}
filters = append(filters, sqlchemy.In(q.Field("id"), GuestManager.Query("secgrp_id").Equals("id", serverId).SubQuery()))
filters = append(filters, sqlchemy.In(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").Equals("guest_id", serverId).SubQuery()))
isAdmin := false
admin, _ := query.Bool("admin")
if consts.IsRbacEnabled() {
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
if allowScope == rbacutils.ScopeSystem || allowScope == rbacutils.ScopeDomain {
isAdmin = true
}
} else if userCred.HasSystemAdminPrivilege() && admin {
isAdmin = true
}
if isAdmin {
filters = append(filters, sqlchemy.In(q.Field("id"), GuestManager.Query("admin_secgrp_id").Equals("id", serverId).SubQuery()))
}
q = q.Filter(sqlchemy.OR(filters...))
}
return q, nil