opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent access from anonymous user (#21241)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2024-09-14 19:36:32 +08:00
committed by GitHub
co-authored by Qiu Jian
parent 2e533b3a46
commit a33aca15de
6 changed files with 51 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/policy/policy.go
+7 -7
View File
@@ -167,7 +167,7 @@ func getMaskedLoginIp(userCred mcclient.TokenCredential) string {
}
func policyKey(userCred mcclient.TokenCredential) string {
if userCred == nil || auth.IsGuestToken(userCred) {
if userCred == nil || len(userCred.GetTokenString()) == 0 || auth.IsGuestToken(userCred) {
return auth.GUEST_TOKEN
}
keys := []string{userCred.GetProjectId()}
@@ -305,12 +305,6 @@ func (manager *SPolicyManager) fetchMatchedPolicies(userCred mcclient.TokenCrede
}
func (manager *SPolicyManager) allow(scope rbacscope.TRbacScope, userCred mcclient.TokenCredential, service string, resource string, action string, extra ...string) rbacutils.SPolicyResult {
// first download userCred policy
policies, err := manager.fetchMatchedPolicies(userCred)
if err != nil {
log.Errorf("fetchMatchedPolicyGroup fail %s", err)
return rbacutils.PolicyDeny
}
// check permission
key := permissionKey(scope, userCred, service, resource, action, extra...)
val := manager.permissionCache.AtomicGet(key)
@@ -321,6 +315,12 @@ func (manager *SPolicyManager) allow(scope rbacscope.TRbacScope, userCred mcclie
return val.(rbacutils.SPolicyResult)
}
// first download userCred policy
policies, err := manager.fetchMatchedPolicies(userCred)
if err != nil {
log.Errorf("fetchMatchedPolicyGroup fail %s", err)
return rbacutils.PolicyDeny
}
policySet, ok := policies.Policies[scope]
if !ok {
policySet = rbacutils.TPolicySet{}