Bug #16884

Create permissions do not check filter limits

Added by Marek Hulán almost 2 years ago. Updated 7 days ago.

Status:Closed
Priority:Normal
Assignee:Marek Hulán
Category:Authorization
Target version:1.16.0
Difficulty: Team Backlog:
Triaged: Fixed in Releases:
Bugzilla link:1384035 Found in Releases:
Pull request:https://github.com/theforeman/foreman/pull/4705, https://github.com/theforeman/foreman/pull/4030

Description

Description of problem:
The user is able to create resource in taxonomies which were not added/associated to resource filter of role.
Also the search condition is ignored on creation.

Version-Release number of selected component (if applicable):
Foreman 1.5+ (including 1.14-dev) / Satellite 6.3 snap 3.0

How reproducible:
Always

Steps to Reproduce:
1. Create role with Organization A and Location A taxonomies.
2. Create a filter for resource type for which taxonomies can be applied and without overriding it.
e.g Domain Filter
3. Create a new user with different taxonomies than above role. Suppose Organization B and Location B.
4. Assign the role to user.
5. Login with new user.
6. Attempt to create a domain(or any resource type filter added in role) in user taxonomies(which are not the same as filter taxonomies).

Similarly in step 3, search condition can be specified, e.g. name ~ a

Actual results:
1. Create permission is not honoring the resourse filter limits.
2. The resource is created in the user associated taxonomies which are not permitted by resource filter.

Similarly the resource is created if name ~ a condition was specified in filter and name "b" was used.

Expected results:
1.Create permissions should check filter limits.
2. The resource should not be created by user in taxonomies to which filter doesn't gives permission.
3. Some informative message should be displayed for unable to create resource due to no permissions from resource filter end.


Related issues

Related to Foreman - Tracker #4552: New permissions/authorization system issues New 03/05/2014
Related to Katello - Bug #20135: Fix tests after create and edit permissions started to be... Closed 06/28/2017
Related to foreman-tasks - Bug #20136: Ignore create_tasks permission verification Closed 06/28/2017
Related to foreman-tasks - Bug #20333: Similar to create permission, we need to ignore update pe... Closed 07/18/2017
Related to Foreman - Bug #20385: rake db:seed fails for plugins Closed 07/23/2017
Related to Foreman - Bug #20384: Initial db:seed fails Closed 07/21/2017
Related to Foreman Remote Execution - Bug #20391: Tests are failing due to permission changes Closed 07/24/2017
Related to Foreman Remote Execution - Refactor #20455: Replace execute permission with create_template_invocation New 07/31/2017
Related to virt-who configure - Bug #21065: Can't create configuration as a user with just "Manager" ... Closed 09/21/2017
Related to Foreman - Bug #22010: Hostgroup creation/edition issue Closed 12/18/2017
Related to Foreman - Bug #22983: Missing permissions seed entry for HostgroupClass Closed 03/22/2018

Associated revisions

Revision 8dcc90be
Added by Marek Hulán 12 months ago

Fixes #16884 - enforce granular filters even during save

Revision 7adb7fa2
Added by Marek Hulán 12 months ago

Refs #16884 - add minitest stubbing to test helper

History

#1 Updated by Marek Hulán almost 2 years ago

  • Subject changed from Create permissions do not check filter limits to Create permissions do not check filter limits
  • Target version set to 115

#2 Updated by Marek Hulán almost 2 years ago

  • Related to Tracker #4552: New permissions/authorization system issues added

#3 Updated by Marek Hulán over 1 year ago

  • Target version changed from 115 to 1.4.2

#4 Updated by Marek Hulán over 1 year ago

  • Status changed from New to Assigned
  • Assignee set to Marek Hulán

#5 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.4.2 to 1.4.4

#6 Updated by The Foreman Bot over 1 year ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/4030 added

#7 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.4.4 to 1.10.1

#8 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.10.1 to 1.10.2

#9 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.10.2 to 1.11.2

#10 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.11.2 to 1.11.4

#11 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.11.4 to 1.12.1

#12 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.12.1 to 1.12.3

#13 Updated by Marek Hulán over 1 year ago

  • Target version changed from 1.12.3 to 1.13.0

#14 Updated by Marek Hulán about 1 year ago

  • Target version changed from 1.13.0 to 1.13.2

#15 Updated by Marek Hulán about 1 year ago

  • Target version changed from 1.13.2 to 1.13.4

#16 Updated by Marek Hulán about 1 year ago

  • Target version changed from 1.13.4 to 115

#17 Updated by Marek Hulán about 1 year ago

  • Related to Bug #20135: Fix tests after create and edit permissions started to be enforced added

#18 Updated by Marek Hulán about 1 year ago

  • Related to Bug #20136: Ignore create_tasks permission verification added

#19 Updated by Marek Hulán 12 months ago

  • Related to Bug #20333: Similar to create permission, we need to ignore update permission added

#20 Updated by Marek Hulán 12 months ago

  • Target version changed from 115 to 1.17.0-RC2

#21 Updated by Anonymous 12 months ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#22 Updated by Marek Hulán 12 months ago

  • Legacy Backlogs Release (now unused) set to 240

#23 Updated by Marek Hulán 12 months ago

  • Related to Bug #20385: rake db:seed fails for plugins added

#24 Updated by Marek Hulán 12 months ago

  • Related to Bug #20384: Initial db:seed fails added

#25 Updated by Adam Ruzicka 12 months ago

  • Related to Bug #20391: Tests are failing due to permission changes added

#26 Updated by The Foreman Bot 12 months ago

  • Pull request https://github.com/theforeman/foreman/pull/4705 added

#27 Updated by Marek Hulán 12 months ago

  • Related to Refactor #20455: Replace execute permission with create_template_invocation added

#28 Updated by Marek Hulán 10 months ago

  • Related to Bug #21065: Can't create configuration as a user with just "Manager" and "Virt-who Manager" roles added

#29 Updated by Michael Moll 4 months ago

  • Related to Bug #22010: Hostgroup creation/edition issue added

#30 Updated by Marek Hulán 3 months ago

  • Related to Bug #22983: Missing permissions seed entry for HostgroupClass added

Also available in: Atom PDF