Merge pull request #1136 in YUNIONIO/onecloud from ~LIZEXI/onecloud:hotfix/lzx-sharable-rbac to release/2.7.0

* commit 'fc3b748039c55da5c65d4bbd7e233dd196866c7c':
  rbac: SharableVirtualResource only allow GET method
This commit is contained in:
邱剑
2019-02-28 21:02:42 +08:00
+1 -1
View File
@@ -92,7 +92,7 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
if len(ownerId) > 0 {
objOwnerId := model.GetOwnerProjectId()
if ownerId == objOwnerId || model.IsSharable() {
if ownerId == objOwnerId || (model.IsSharable() && action == policy.PolicyActionGet) {
isOwner = true
requireAdmin = false
} else {