Bug #22618
openGranular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions
Description
Description of problem:
When users create custom roles where filters contain ^ and !^ operators in search query, the UI will start showing many SQL exceptions because the operators are wrongly translated to the SQL language.
~~
PG::Error: ERROR: missing FROM-clause entry for table "taxonomies" LINE 1: ...) AND "hosts"."location_id" IN (5, 8, 2, 6) AND (("taxonomie... ^ : SELECT COUNT FROM (SELECT DISTINCT "katello_errata"."id" AS count_column FROM "katello_errata" INNER JOIN "katello_content_facet_errata" ON "katello_content_facet_errata"."erratum_id" = "katello_errata"."id" INNER JOIN "katello_content_facets" ON "katello_content_facets"."id" = "katello_content_facet_errata"."content_facet_id" WHERE "katello_content_facets"."host_id" IN (SELECT "hosts"."id" FROM "hosts" WHERE "hosts"."type" IN ('Host::Managed') AND "hosts"."organization_id" IN (3) AND "hosts"."location_id" IN (5, 8, 2, 6) AND (("taxonomies"."title" = 'test'))) LIMIT 6) subquery_for_count
~~
~~
PG::Error: ERROR: syntax error at or near "'test-'" LINE 9: ...locks_owner.resource_id = 8) OR (users."login" IN 'test-') O... ^ : SELECT DISTINCT foreman_tasks_tasks.*, "foreman_tasks_tasks"."id" AS t0_r0, "foreman_tasks_tasks"."type" AS t0_r1, "foreman_tasks_tasks"."label" AS t0_r2, "foreman_tasks_tasks"."started_at" AS t0_r3, "foreman_tasks_tasks"."ended_at" AS t0_r4, "foreman_tasks_tasks"."state" AS t0_r5, "foreman_tasks_tasks"."result" AS t0_r6, "foreman_tasks_tasks"."external_id" AS t0_r7, "foreman_tasks_tasks"."parent_task_id" AS t0_r8, "foreman_tasks_tasks"."start_at" AS t0_r9, "foreman_tasks_tasks"."start_before" AS t0_r10 FROM "foreman_tasks_tasks" INNER JOIN foreman_tasks_locks AS foreman_tasks_locks_owner ON (foreman_tasks_locks_owner.task_id = foreman_tasks_tasks.id AND foreman_tasks_locks_owner.resource_type = 'User' AND foreman_tasks_locks_owner.name = 'task_owner') INNER JOIN foreman_tasks_locks AS foreman_tasks_locks_owner ON (foreman_tasks_locks_owner.task_id = foreman_tasks_tasks.id AND foreman_tasks_locks_owner.resource_type = 'User' AND foreman_tasks_locks_owner.name = 'task_owner') INNER JOIN users ON (users.id = foreman_tasks_locks_owner.resource_id) WHERE (((foreman_tasks_locks_owner.resource_id = 8) OR (users."login" IN 'test-') OR (users."login" = 'foreman_admin'))) ORDER BY "foreman_tasks_tasks"."started_at" DESC NULLS LAST LIMIT 20 OFFSET 0
~~
How reproducible:
Apply the attached set of rules and create a user with the role, you have created. Then login as the newly created user.
Steps to Reproduce:
1. Download the org-perms-default.sh
2. Edit it and set the unit and unit_org_id (unit = organization, unit_org_id = organization id)
3. Run the org-perms-default.sh
4. Create an user with org-admin-${unit} role
5. Login as the newly created user and try access these pages:
https://$(hostname)/dashboard
https://$(hostname)/foreman_tasks/tasks
Actual results:
Hitting the errors.
Expected results:
All the pages will be displayed correctly respecting the role search rules.
Files
Updated by Ondřej Pražák about 7 years ago
- File org-perms-default.sh org-perms-default.sh added
- Subject changed from Granular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions to Granular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions
- Category set to Search