Bug #30880: Add permission support to validate 404 on denial and multi permissions - Katello - Foreman

Actions

Copy link

Bug #30880

closed

Add permission support to validate 404 on denial and multi permissions

Added by Partha Aji over 4 years ago. Updated about 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Partha Aji

Category:

Security

Target version:

Katello 3.18.0

Difficulty:

Triaged:

Yes

Bugzilla link:

Pull request:

https://github.com/Katello/katello/pull/8956

Fixed in Releases:

Katello 4.0.0

Found in Releases:

Red Hat JIRA:

Description

The current testing framework does not handle 404s on denial. This behaviour is consistent with foreman, 404 instead of 403 if object not authorized. 403 is only when route is not authorized.
We need to add support to this.
The current authorization does not handle multi permissions also. For example destroy_content_views and promote_or_remove_content_views either support 'removing' a content view. However the controller authorizer does not handle this correctly.

Related issues 1 (0 open — 1 closed)