diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index feb35ce643..ce15b585ba 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -430,15 +430,30 @@ func (self *SOpsLogManager) FilterByOwner(q *sqlchemy.SQuery, ownerId mcclient.I switch scope { case rbacutils.ScopeUser: if len(ownerId.GetUserId()) > 0 { + /* + * 默认只能查看本人发起的操作 + */ q = q.Filter(sqlchemy.Equals(q.Field("user_id"), ownerId.GetUserId())) } case rbacutils.ScopeProject: if len(ownerId.GetProjectId()) > 0 { - q = q.Filter(sqlchemy.Equals(q.Field("tenant_id"), ownerId.GetProjectId())) + /* + * 项目视图可以查看本项目人员发起的操作,或者对本项目资源实施的操作, QIU Jian + */ + q = q.Filter(sqlchemy.OR( + sqlchemy.Equals(q.Field("tenant_id"), ownerId.GetProjectId()), + sqlchemy.Equals(q.Field("owner_tenant_id"), ownerId.GetProjectId()), + )) } case rbacutils.ScopeDomain: if len(ownerId.GetProjectDomainId()) > 0 { - q = q.Filter(sqlchemy.Equals(q.Field("project_domain_id"), ownerId.GetProjectDomainId())) + /* + * 域视图可以查看本域人员发起的操作,或者对本域资源实施的操作, QIU Jian + */ + q = q.Filter(sqlchemy.OR( + sqlchemy.Equals(q.Field("project_domain_id"), ownerId.GetProjectDomainId()), + sqlchemy.Equals(q.Field("owner_domain_id"), ownerId.GetProjectDomainId()), + )) } default: // systemScope, no filter