opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2473 from swordqiu/hotfix/qj-domain-admin-private-project-network

Browse Source 
fix: doamin admin cannot access private networks across domain
This commit is contained in:
yunion-ci-robot
2019-08-22 09:48:07 +08:00
committed by GitHub
parent e87695d0fb 4960b9cebc
commit ba4d2e4537
2 changed files with 84 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/rbac.go
+80
View File
@@ -134,6 +134,14 @@ func IsAdminAllowList(userCred mcclient.TokenCredential, manager IResource) bool
return IsAllowList(rbacutils.ScopeSystem, userCred, manager)
}
func IsDomainAllowList(userCred mcclient.TokenCredential, manager IResource) bool {
return IsAllowList(rbacutils.ScopeDomain, userCred, manager)
}
func IsProjectAllowList(userCred mcclient.TokenCredential, manager IResource) bool {
return IsAllowList(rbacutils.ScopeProject, userCred, manager)
}
func IsAllowCreate(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, manager IResource) bool {
if userCred == nil {
return false
@@ -145,6 +153,14 @@ func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IResource) bo
return IsAllowCreate(rbacutils.ScopeSystem, userCred, manager)
}
func IsDomainAllowCreate(userCred mcclient.TokenCredential, manager IResource) bool {
return IsAllowCreate(rbacutils.ScopeDomain, userCred, manager)
}
func IsProjectAllowCreate(userCred mcclient.TokenCredential, manager IResource) bool {
return IsAllowCreate(rbacutils.ScopeProject, userCred, manager)
}
func IsAllowClassPerform(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, manager IResource, action string) bool {
if userCred == nil {
return false
@@ -156,6 +172,14 @@ func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IResour
return IsAllowClassPerform(rbacutils.ScopeSystem, userCred, manager, action)
}
func IsDomainAllowClassPerform(userCred mcclient.TokenCredential, manager IResource, action string) bool {
return IsAllowClassPerform(rbacutils.ScopeDomain, userCred, manager, action)
}
func IsProjectAllowClassPerform(userCred mcclient.TokenCredential, manager IResource, action string) bool {
return IsAllowClassPerform(rbacutils.ScopeProject, userCred, manager, action)
}
func IsAllowGet(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
if userCred == nil {
return false
@@ -167,6 +191,14 @@ func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowGet(rbacutils.ScopeSystem, userCred, obj)
}
func IsDomainAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowGet(rbacutils.ScopeDomain, userCred, obj)
}
func IsProjectAllowGet(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowGet(rbacutils.ScopeProject, userCred, obj)
}
func IsAllowGetSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
if userCred == nil {
return false
@@ -178,6 +210,14 @@ func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec
return IsAllowGetSpec(rbacutils.ScopeSystem, userCred, obj, spec)
}
func IsDomainAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowGetSpec(rbacutils.ScopeDomain, userCred, obj, spec)
}
func IsProjectAllowGetSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowGetSpec(rbacutils.ScopeProject, userCred, obj, spec)
}
func IsAllowPerform(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, action string) bool {
if userCred == nil {
return false
@@ -189,6 +229,14 @@ func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IResource, actio
return IsAllowPerform(rbacutils.ScopeSystem, userCred, obj, action)
}
func IsDomainAllowPerform(userCred mcclient.TokenCredential, obj IResource, action string) bool {
return IsAllowPerform(rbacutils.ScopeDomain, userCred, obj, action)
}
func IsProjectAllowPerform(userCred mcclient.TokenCredential, obj IResource, action string) bool {
return IsAllowPerform(rbacutils.ScopeProject, userCred, obj, action)
}
func IsAllowUpdate(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
if userCred == nil {
return false
@@ -200,6 +248,14 @@ func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowUpdate(rbacutils.ScopeSystem, userCred, obj)
}
func IsDomainAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowUpdate(rbacutils.ScopeDomain, userCred, obj)
}
func IsProjectAllowUpdate(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowUpdate(rbacutils.ScopeProject, userCred, obj)
}
func IsAllowUpdateSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
if userCred == nil {
return false
@@ -211,6 +267,14 @@ func IsAdminAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, sp
return IsAllowUpdateSpec(rbacutils.ScopeSystem, userCred, obj, spec)
}
func IsDomainAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowUpdateSpec(rbacutils.ScopeDomain, userCred, obj, spec)
}
func IsProjectAllowUpdateSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowUpdateSpec(rbacutils.ScopeProject, userCred, obj, spec)
}
func IsAllowDelete(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource) bool {
if userCred == nil {
return false
@@ -222,6 +286,14 @@ func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowDelete(rbacutils.ScopeSystem, userCred, obj)
}
func IsDomainAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowDelete(rbacutils.ScopeDomain, userCred, obj)
}
func IsProjectAllowDelete(userCred mcclient.TokenCredential, obj IResource) bool {
return IsAllowDelete(rbacutils.ScopeProject, userCred, obj)
}
func IsAllowDeleteSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, obj IResource, spec string) bool {
if userCred == nil {
return false
@@ -232,3 +304,11 @@ func IsAllowDeleteSpec(scope rbacutils.TRbacScope, userCred mcclient.TokenCreden
func IsAdminAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowDeleteSpec(rbacutils.ScopeSystem, userCred, obj, spec)
}
func IsDomainAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowDeleteSpec(rbacutils.ScopeDomain, userCred, obj, spec)
}
func IsProjectAllowDeleteSpec(userCred mcclient.TokenCredential, obj IResource, spec string) bool {
return IsAllowDeleteSpec(rbacutils.ScopeProject, userCred, obj, spec)
}
pkg/compute/models/networks.go
+4 -1
View File
@@ -831,7 +831,10 @@ func parseNetworkInfo(userCred mcclient.TokenCredential, info *api.NetworkConfig
}
}
net := netObj.(*SNetwork)
if net.IsOwner(userCred) || net.IsPublic || db.IsAdminAllowGet(userCred, net) ||
if net.IsPublic ||
net.ProjectId == userCred.GetProjectId() ||
(db.IsDomainAllowGet(userCred, net) && net.DomainId == userCred.GetProjectDomainId()) ||
db.IsAdminAllowGet(userCred, net) ||
utils.IsInStringArray(userCred.GetProjectId(), net.GetSharedProjects()) {
info.Network = netObj.GetId()
} else {