From ea254c8ed8283a058f14d17c5763e39074a67c05 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Wed, 22 Apr 2020 11:50:33 +0800 Subject: [PATCH] fix: do not share porject resource by default --- pkg/cloudcommon/db/sharablebase.go | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/pkg/cloudcommon/db/sharablebase.go b/pkg/cloudcommon/db/sharablebase.go index b690836616..1f3cfd2ccb 100644 --- a/pkg/cloudcommon/db/sharablebase.go +++ b/pkg/cloudcommon/db/sharablebase.go @@ -539,17 +539,19 @@ func SharableModelIsShared(model ISharableBaseModel) bool { func SharableModelCustomizeCreate(model ISharableBaseModel, ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) error { if !data.Contains("public_scope") { resScope := model.GetModelManager().ResourceScope() - isManaged := false - if managedModel, ok := model.(IManagedResourceBase); ok { - isManaged = managedModel.IsManaged() - } - if !isManaged && IsAdminAllowPerform(userCred, model, "public") && ownerId.GetProjectDomainId() == userCred.GetProjectDomainId() { - model.SetShare(rbacutils.ScopeSystem) - } else if !isManaged && IsDomainAllowPerform(userCred, model, "public") && resScope == rbacutils.ScopeProject && ownerId.GetProjectId() == userCred.GetProjectId() { - model.SetShare(rbacutils.ScopeDomain) - } else { - model.SetShare(rbacutils.ScopeNone) + if resScope == rbacutils.ScopeDomain { + isManaged := false + if managedModel, ok := model.(IManagedResourceBase); ok { + isManaged = managedModel.IsManaged() + } + if !isManaged && IsAdminAllowPerform(userCred, model, "public") && ownerId.GetProjectDomainId() == userCred.GetProjectDomainId() { + model.SetShare(rbacutils.ScopeSystem) + data.(*jsonutils.JSONDict).Set("public_scope", jsonutils.NewString(string(rbacutils.ScopeSystem))) + } } } + if !data.Contains("public_scope") { + model.SetShare(rbacutils.ScopeNone) + } return nil }