From 4a9549a6be79cfb3653bfc20d94e2c3a9971f8ab Mon Sep 17 00:00:00 2001 From: Qu Xuan Date: Fri, 27 Dec 2019 16:40:34 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=94=AF=E6=8C=81=E8=BF=87=E6=BB=A4?= =?UTF-8?q?=E6=9C=89admin=5Fsecgrp=E7=9A=84=E8=99=9A=E6=8B=9F=E6=9C=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/apis/compute/secgroup.go | 2 ++ pkg/compute/models/guests.go | 36 +++++++++++++++++++++++++-------- pkg/compute/models/secgroups.go | 27 +++++++++++++++++++------ 3 files changed, 51 insertions(+), 14 deletions(-) diff --git a/pkg/apis/compute/secgroup.go b/pkg/apis/compute/secgroup.go index 6adb5a05d5..a0a29dd24e 100644 --- a/pkg/apis/compute/secgroup.go +++ b/pkg/apis/compute/secgroup.go @@ -77,6 +77,8 @@ type SSecgroupCreateInput struct { } type SSecgroupListFilterInput struct { + apis.BaseListInput + Equals string Server string } diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index fdf9c9162f..9e75d9db1c 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -42,10 +42,12 @@ import ( imageapi "yunion.io/x/onecloud/pkg/apis/image" schedapi "yunion.io/x/onecloud/pkg/apis/scheduler" "yunion.io/x/onecloud/pkg/cloudcommon/cmdline" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/userdata" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" @@ -234,16 +236,34 @@ func (manager *SGuestManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQ secgrpIds = append(secgrpIds, secgrp.Id) } + isAdmin := false + admin, _ := query.Bool("admin") + if consts.IsRbacEnabled() { + allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + if allowScope == rbacutils.ScopeSystem || allowScope == rbacutils.ScopeDomain { + isAdmin = true + } + } else if userCred.HasSystemAdminPrivilege() && admin { + isAdmin = true + } + + filters := []sqlchemy.ICondition{} if notIn { - filter1 := sqlchemy.NotIn(q.Field("id"), - GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery()) - filter2 := sqlchemy.NotIn(q.Field("secgrp_id"), secgrpIds) - q = q.Filter(sqlchemy.AND(filter1, filter2)) + filters = append(filters, sqlchemy.NotIn(q.Field("id"), + GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery())) + filters = append(filters, sqlchemy.NotIn(q.Field("secgrp_id"), secgrpIds)) + if isAdmin { + filters = append(filters, sqlchemy.NotIn(q.Field("admin_secgrp_id"), secgrpIds)) + } + q = q.Filter(sqlchemy.AND(filters...)) } else { - filter1 := sqlchemy.In(q.Field("id"), - GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery()) - filter2 := sqlchemy.In(q.Field("secgrp_id"), secgrpIds) - q = q.Filter(sqlchemy.OR(filter1, filter2)) + filters = append(filters, sqlchemy.In(q.Field("id"), + GuestsecgroupManager.Query("guest_id").In("secgroup_id", secgrpIds).SubQuery())) + filters = append(filters, sqlchemy.In(q.Field("secgrp_id"), secgrpIds)) + if isAdmin { + filters = append(filters, sqlchemy.In(q.Field("admin_secgrp_id"), secgrpIds)) + } + q = q.Filter(sqlchemy.OR(filters...)) } } diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go index 5e3b1980b7..2f02a57aeb 100644 --- a/pkg/compute/models/secgroups.go +++ b/pkg/compute/models/secgroups.go @@ -30,10 +30,12 @@ import ( "yunion.io/x/sqlchemy" api "yunion.io/x/onecloud/pkg/apis/compute" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" @@ -112,12 +114,25 @@ func (manager *SSecurityGroupManager) ListItemFilter(ctx context.Context, q *sql return nil, httperrors.NewGeneralError(err) } serverId := guest.GetId() - sq1 := GuestManager.Query("secgrp_id").Equals("id", serverId).SubQuery() - sq2 := GuestsecgroupManager.Query("secgroup_id").Equals("guest_id", serverId).SubQuery() - q = q.Filter(sqlchemy.OR( - sqlchemy.In(q.Field("id"), sq1), - sqlchemy.In(q.Field("id"), sq2), - )) + filters := []sqlchemy.ICondition{} + filters = append(filters, sqlchemy.In(q.Field("id"), GuestManager.Query("secgrp_id").Equals("id", serverId).SubQuery())) + filters = append(filters, sqlchemy.In(q.Field("id"), GuestsecgroupManager.Query("secgroup_id").Equals("guest_id", serverId).SubQuery())) + + isAdmin := false + admin, _ := query.Bool("admin") + if consts.IsRbacEnabled() { + allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + if allowScope == rbacutils.ScopeSystem || allowScope == rbacutils.ScopeDomain { + isAdmin = true + } + } else if userCred.HasSystemAdminPrivilege() && admin { + isAdmin = true + } + + if isAdmin { + filters = append(filters, sqlchemy.In(q.Field("id"), GuestManager.Query("admin_secgrp_id").Equals("id", serverId).SubQuery())) + } + q = q.Filter(sqlchemy.OR(filters...)) } return q, nil