opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-01 15:07:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: check permission for getallmetadata params (#12815)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2021-12-05 08:59:12 +08:00
committed by GitHub
parent e57b5117e3
commit f1a613e15a
8 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/interface.go
+1 -1
View File
@@ -287,7 +287,7 @@ type IStandaloneModel interface {
SetCloudMetadataAll(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error
RemoveMetadata(ctx context.Context, key string, userCred mcclient.TokenCredential) error
RemoveAllMetadata(ctx context.Context, userCred mcclient.TokenCredential) error
GetAllMetadata(userCred mcclient.TokenCredential) (map[string]string, error)
GetAllMetadata(ctx context.Context, userCred mcclient.TokenCredential) (map[string]string, error)
IsShared() bool
pkg/cloudcommon/db/metadata.go
+19 -16
View File
@@ -144,7 +144,7 @@ func (m *SMetadata) GetModelManager() IModelManager {
return Metadata
}
func getModelIdstr(model IModel) string {
func GetModelIdstr(model IModel) string {
return getObjectIdstr(model.GetModelManager().Keyword(), model.GetId())
}
@@ -169,10 +169,6 @@ func (m *SMetadata) Delete(ctx context.Context, userCred mcclient.TokenCredentia
return DeleteModel(ctx, userCred, m)
}
func (manager *SMetadataManager) AllowGetPropertyTagValuePairs(ctx context.Context, userCred mcclient.TokenCredential, input apis.MetadataListInput) bool {
return true
}
func (manager *SMetadataManager) fetchKeyValueQuery(
ctx context.Context,
userCred mcclient.TokenCredential,
@@ -347,10 +343,6 @@ func (manager *SMetadataManager) getKeyValueObjectCount(ctx context.Context, use
return data, nil
}
func (manager *SMetadataManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return true
}
func (manager *SMetadataManager) metadataBaseFilter(q *sqlchemy.SQuery, input apis.MetadataBaseFilterInput) *sqlchemy.SQuery {
if len(input.Key) > 0 {
q = q.In("key", input.Key)
@@ -450,7 +442,7 @@ func (manager *SMetadataManager) GetStringValue(ctx context.Context, model IMode
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAllowGetSpec(ctx, rbacutils.ScopeSystem, userCred, model, "metadata")) {
return ""
}
idStr := getModelIdstr(model)
idStr := GetModelIdstr(model)
m := SMetadata{}
err := manager.Query().Equals("id", idStr).Equals("key", key).First(&m)
if err == nil {
@@ -463,7 +455,7 @@ func (manager *SMetadataManager) GetJsonValue(ctx context.Context, model IModel,
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAllowGetSpec(ctx, rbacutils.ScopeSystem, userCred, model, "metadata")) {
return nil
}
idStr := getModelIdstr(model)
idStr := GetModelIdstr(model)
m := SMetadata{}
err := manager.Query().Equals("id", idStr).Equals("key", key).First(&m)
if err == nil {
@@ -480,7 +472,7 @@ type sMetadataChange struct {
}
func (manager *SMetadataManager) RemoveAll(ctx context.Context, model IModel, userCred mcclient.TokenCredential) error {
idStr := getModelIdstr(model)
idStr := GetModelIdstr(model)
if len(idStr) == 0 {
return fmt.Errorf("invalid model")
}
@@ -651,8 +643,19 @@ func (manager *SMetadataManager) SetAll(ctx context.Context, obj IModel, store m
return nil
}
func (manager *SMetadataManager) GetAll(obj IModel, keys []string, keyPrefix string) (map[string]string, error) {
return manager.rawGetAll(obj.Keyword(), obj.GetId(), keys, keyPrefix)
func (manager *SMetadataManager) GetAll(ctx context.Context, obj IModel, keys []string, keyPrefix string, userCred mcclient.TokenCredential) (map[string]string, error) {
meta, err := manager.rawGetAll(obj.Keyword(), obj.GetId(), keys, keyPrefix)
if err != nil {
return nil, errors.Wrap(err, "rawGetAll")
}
ret := make(map[string]string)
for k, v := range meta {
if strings.HasPrefix(k, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAllowGetSpec(ctx, rbacutils.ScopeSystem, userCred, obj, "metadata")) {
continue
}
ret[k] = v
}
return ret, nil
}
func (manager *SMetadataManager) rawGetAll(objType, objId string, keys []string, keyPrefix string) (map[string]string, error) {
@@ -698,8 +701,8 @@ func IsMetadataKeyVisiable(key string) bool {
return !(IsMetadataKeySysTag(key) || IsMetadataKeySystemAdmin(key))
}
func GetVisiableMetadata(model IStandaloneModel, userCred mcclient.TokenCredential) (map[string]string, error) {
metaData, err := model.GetAllMetadata(userCred)
func GetVisiableMetadata(ctx context.Context, model IStandaloneModel, userCred mcclient.TokenCredential) (map[string]string, error) {
metaData, err := model.GetAllMetadata(ctx, userCred)
if err != nil {
return nil, err
}
pkg/cloudcommon/db/metadata_test.go
+3 -2
View File
@@ -15,6 +15,7 @@
package db
import (
"context"
"reflect"
"testing"
@@ -116,7 +117,7 @@ type MockMetadataModel struct {
SStandaloneResourceBase
}
func (m *MockMetadataModel) GetAllMetadata(userCred mcclient.TokenCredential) (map[string]string, error) {
func (m *MockMetadataModel) GetAllMetadata(ctx context.Context, userCred mcclient.TokenCredential) (map[string]string, error) {
args := m.Called(userCred)
return args.Get(0).(map[string]string), args.Error(1)
}
@@ -160,7 +161,7 @@ func TestGetVisiableMetadata(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := GetVisiableMetadata(tt.model, nil)
got, err := GetVisiableMetadata(nil, tt.model, nil)
if (err != nil) != tt.wantErr {
t.Errorf("GetVisiableMetadata() error = %v, wantErr %v", err, tt.wantErr)
return
pkg/cloudcommon/db/metadataresource.go
+1 -1
View File
@@ -186,7 +186,7 @@ func (meta *SMetadataResourceBaseModelManager) FetchCustomizeColumns(
ret := make([]apis.MetadataResourceInfo, len(objs))
resIds := make([]string, len(objs))
for i := range objs {
resIds[i] = getModelIdstr(objs[i].(IModel))
resIds[i] = GetModelIdstr(objs[i].(IModel))
}
if fields == nil || fields.Contains("__meta__") {
pkg/cloudcommon/db/standalone_anon.go
+5 -5
View File
@@ -298,12 +298,12 @@ func (model *SStandaloneAnonResourceBase) RemoveAllMetadata(ctx context.Context,
return nil
}
func (model *SStandaloneAnonResourceBase) GetAllMetadata(userCred mcclient.TokenCredential) (map[string]string, error) {
return Metadata.GetAll(model, nil, "")
func (model *SStandaloneAnonResourceBase) GetAllMetadata(ctx context.Context, userCred mcclient.TokenCredential) (map[string]string, error) {
return Metadata.GetAll(ctx, model, nil, "", userCred)
}
func (model *SStandaloneAnonResourceBase) GetAllUserMetadata() (map[string]string, error) {
meta, err := Metadata.GetAll(model, nil, USER_TAG_PREFIX)
meta, err := Metadata.GetAll(nil, model, nil, USER_TAG_PREFIX, nil)
if err != nil {
return nil, errors.Wrap(err, "Metadata.GetAll")
}
@@ -315,7 +315,7 @@ func (model *SStandaloneAnonResourceBase) GetAllUserMetadata() (map[string]strin
}
func (model *SStandaloneAnonResourceBase) GetAllCloudMetadata() (map[string]string, error) {
meta, err := Metadata.GetAll(model, nil, CLOUD_TAG_PREFIX)
meta, err := Metadata.GetAll(nil, model, nil, CLOUD_TAG_PREFIX, nil)
if err != nil {
return nil, errors.Wrap(err, "Metadata.GetAll")
}
@@ -328,7 +328,7 @@ func (model *SStandaloneAnonResourceBase) GetAllCloudMetadata() (map[string]stri
// 获取资源标签（元数据）
func (model *SStandaloneAnonResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, input apis.GetMetadataInput) (apis.GetMetadataOutput, error) {
val, err := Metadata.GetAll(model, input.Field, input.Prefix)
val, err := Metadata.GetAll(ctx, model, input.Field, input.Prefix, userCred)
if err != nil {
return nil, errors.Wrap(err, "Metadata.GetAll")
}
pkg/compute/models/guest_actions.go
+2 -2
View File
@@ -838,7 +838,7 @@ func (self *SGuest) EventNotify(ctx context.Context, userCred mcclient.TokenCred
if action != notifyclient.ActionCreate && action != notifyclient.ActionRebuildRoot && action != notifyclient.ActionResetPassword {
return
}
meta, err := self.GetAllMetadata(nil)
meta, err := self.GetAllMetadata(ctx, userCred)
if err != nil {
return
}
@@ -881,7 +881,7 @@ func (self *SGuest) NotifyServerEvent(
ctx context.Context, userCred mcclient.TokenCredential, event string, priority notify.TNotifyPriority,
loginInfo bool, kwargs *jsonutils.JSONDict, notifyAdmin bool,
) {
meta, err := self.GetAllMetadata(nil)
meta, err := self.GetAllMetadata(ctx, userCred)
if err != nil {
return
}
pkg/compute/models/guests.go
+2 -2
View File
@@ -4043,7 +4043,7 @@ func (self *SGuest) GetJsonDescAtHypervisor(ctx context.Context, host *SHost) *a
desc.OsName = self.GetOS()
desc.Metadata, _ = self.GetAllMetadata(nil)
desc.Metadata, _ = self.GetAllMetadata(ctx, nil)
userData, _ := desc.Metadata["user_data"]
if len(userData) > 0 {
@@ -4122,7 +4122,7 @@ func (self *SGuest) GetJsonDescAtBaremetal(ctx context.Context, host *SHost) *ap
}
desc.OsName = self.GetOS()
desc.Metadata, _ = self.GetAllMetadata(nil)
desc.Metadata, _ = self.GetAllMetadata(ctx, nil)
desc.UserData, _ = desc.Metadata["user_data"]
desc.PendingDeleted = self.PendingDeleted
pkg/scheduler/cache/candidate/hosts.go
Vendored
+1 -1
View File
@@ -995,7 +995,7 @@ func (b *HostBuilder) fillResidentGroups(desc *HostDesc, host *computemodels.SHo
}*/
func (b *HostBuilder) fillMetadata(desc *HostDesc, host *computemodels.SHost) error {
metadata, err := host.GetAllMetadata(nil)
metadata, err := host.GetAllMetadata(nil, nil)
if err != nil {
log.Errorf("Get host %s metadata: %v", desc.GetId(), err)
return nil