Bug #18838
Managing repositories with their id via hammer does not respect the role filters
Description
Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1429590
Description of problem:
After settings a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.
How reproducible:
100%
Steps to Reproduce:
1. Have repositories from more than 1 Product, by example:
Red Hat Enterprise Linux Server
Red Hat Satellite
Custom_Product
Optional -> You can also have 2 Organization and only allow 1 of them through the filter:
MyOrg
OtherOrg
2. Create a new role "Custom_bug_role"
3. Create the following 2 filters for that role
Filter 1
Resource type: Organization
Permission: view_organizations
Search filter: name = "MyOrg"
Filter 2
Resource type: Product and Repositories
Permission: view_products, edit_products, sync_products
Search filter: name = "Red Hat Enterprise Linux Server"
4. Create a test user and assign the custom role
Username: Test_bug_user
Role: Custom_bug_role
5. With hammer, list the repository using the test user credentials
A. Listing the repositories works as expected, only "Red Hat Enterprise Linux Server" repositories will be displayed:
# hammer -u Test_bug_user -p testbug repository list --organization MyOrg
[...]
33 | Red Hat Enterprise Linux 7 Server Kickstart x86_64 7.1 | Red Hat Enterprise Linux Server | yum
27 | Red Hat Enterprise Linux 7 Server - Extras RPMs x86_64 | Red Hat Enterprise Linux Server | yum
[...]
B. Showing repository information using it's ID allows the user to see any repository (from any Product or any Organisation), this is not expected:
# hammer -u Test_bug_user -p testbug repository info --id 62
ID: 62
Name: Custom_Repo
Label: Custom_Repo
Organization: OtherOrg
Red Hat Repository: no
Content Type: yum
[...]
C. Uploading a package to a any repository is also possible using its ID (from any Product or any Organisation), this is not expected:
# hammer -u Test_bug_user -p testbug repository upload-content --id 62 --path test.rpm
Successfully uploaded file 'test.rpm'.
It seems like when we specify --product --name --organization, the permission are applied correctly. However, it looks like using their id bypass this.
Actual results:
When using repository id, we can show info from any repository and upload new package to them.
Expected results:
Have the role filters applied on the resource whether we are using the name or the id
Related issues
History
#1
Updated by Brad Buckingham about 6 years ago
- Subject changed from Managing repositories with their id via hammer does not respect the role filters to Managing repositories with their id via hammer does not respect the role filters
- Priority changed from Urgent to High
- Target version set to 169
- Legacy Backlogs Release (now unused) set to 211
#2
Updated by The Foreman Bot about 6 years ago
- Status changed from New to Ready For Testing
- Pull request https://github.com/Katello/katello/pull/6659 added
#3
Updated by Brad Buckingham about 6 years ago
- Target version changed from 169 to 178
#4
Updated by Justin Sherrill about 6 years ago
- Legacy Backlogs Release (now unused) changed from 211 to 228
#5
Updated by Brad Buckingham about 6 years ago
- Target version changed from 178 to 181
#6
Updated by Brad Buckingham about 6 years ago
- Target version changed from 181 to 187
#7
Updated by Brad Buckingham about 6 years ago
- Target version changed from 187 to 193
#8
Updated by Justin Sherrill about 6 years ago
- Status changed from Ready For Testing to New
- Pull request deleted (
https://github.com/Katello/katello/pull/6659)
#9
Updated by Justin Sherrill almost 6 years ago
- Legacy Backlogs Release (now unused) changed from 228 to 258
#10
Updated by Brad Buckingham almost 6 years ago
- Target version changed from 193 to 196
#11
Updated by Justin Sherrill almost 6 years ago
- Legacy Backlogs Release (now unused) changed from 258 to 267
#12
Updated by Brad Buckingham almost 6 years ago
- Target version changed from 196 to 202
#13
Updated by Justin Sherrill almost 6 years ago
- Legacy Backlogs Release (now unused) changed from 267 to 281
#14
Updated by Brad Buckingham almost 6 years ago
- Target version changed from 202 to 205
#15
Updated by Eric Helms almost 6 years ago
- Legacy Backlogs Release (now unused) changed from 281 to 286
#16
Updated by Brad Buckingham almost 6 years ago
- Is duplicate of Bug #18035: Should only be able to add repositories you have access to added
#17
Updated by Brad Buckingham almost 6 years ago
- Status changed from New to Duplicate