opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(notify): solve the permission problem of subscriber

Browse Source
This commit is contained in:
rainzm
2021-09-27 19:06:24 +08:00
parent e300795f42
commit e1f8850f25
2 changed files with 48 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/notify/models/subscriber.go
+6 -6
View File
@@ -162,8 +162,8 @@ func (sm *SSubscriberManager) ValidateCreateData(ctx context.Context, userCred m
input.ResourceAttributionId = tenant.Id
input.ResourceAttributionName = tenant.Name
}
if input.Scope == sDomain && domainId != userCred.GetDomainId() {
return input, httperrors.NewForbiddenError("domain %s admin can't create subscriber for domain %s", userCred.GetDomainId(), domainId)
if input.Scope == sDomain && domainId != userCred.GetProjectDomainId() {
return input, httperrors.NewForbiddenError("domain %s admin can't create subscriber for domain %s", userCred.GetProjectDomainId(), domainId)
}
var checkQuery *sqlchemy.SQuery
@@ -263,7 +263,7 @@ func (s *SSubscriber) PerformChange(ctx context.Context, userCred mcclient.Token
if !db.IsDomainAllowUpdate(userCred, s) {
return nil, httperrors.NewForbiddenError("")
}
if s.DomainId != userCred.GetDomainId() {
if s.DomainId != userCred.GetProjectDomainId() {
return nil, httperrors.NewForbiddenError("")
}
}
@@ -314,11 +314,11 @@ func (sm *SSubscriberManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQ
return nil, httperrors.NewForbiddenError("")
}
case sDomain:
allow := db.IsAdminAllowList(userCred, sm)
allow := db.IsDomainAllowList(userCred, sm)
if !allow {
return nil, httperrors.NewForbiddenError("")
}
q = q.Equals("domain_id", userCred.GetDomainId())
q = q.Equals("domain_id", userCred.GetProjectDomainId())
default:
return nil, httperrors.NewInputParameterError("unkown scope %s", input.Scope)
}
@@ -375,7 +375,7 @@ func (s *SSubscriber) CustomizeDelete(ctx context.Context, userCred mcclient.Tok
if !db.IsDomainAllowDelete(userCred, s) {
return httperrors.NewForbiddenError("")
}
if s.DomainId != userCred.GetDomainId() {
if s.DomainId != userCred.GetProjectDomainId() {
return httperrors.NewForbiddenError("")
}
}
pkg/notify/policy/defaults.go
+42
View File
@@ -91,6 +91,48 @@ var (
},
},
},
{
Auth: true,
Scope: rbacutils.ScopeSystem,
Rules: []rbacutils.SRbacRule{
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionGet,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionList,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionCreate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionUpdate,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionDelete,
Result: rbacutils.Allow,
},
{
Service: api.SERVICE_TYPE,
Resource: "subscribers",
Action: PolicyActionPerform,
Result: rbacutils.Allow,
},
},
},
}
)