Actions
Bug #6760
openModels should ensure the authorization of associated objects before associating them to the model
Status:
New
Priority:
Normal
Assignee:
-
Category:
Users, Roles and Permissions
Target version:
-
Description
While this issue is systematic, I'll provide an example using domains and subnets to illustrate the problem.
As an admin:
1. Create a new domain: "example.org"
2. Create a User: "testuser"
3. Create a new Role: "Subnets Role"
4. Add a Filter to the Role with - Type: Subnets, Permissions: create_subnets, view_subnets
As testuser:
curl -u testuser:testuser -X POST -d '{"name": "subnet1", "network": "255.168.192.1", "mask": "255.255.255.0", "domains": [{"id": 1}]}' -H "Content-Type: application/json" http://10.13.129.41:3000/api/v2/subnets
Updated by The Foreman Bot about 10 years ago
- Status changed from New to Ready For Testing
- Target version set to 49
- Pull request https://github.com/Katello/katello/pull/4483 added
- Pull request deleted (
)
Updated by Eric Helms about 10 years ago
- Project changed from Katello to Foreman
- Target version deleted (
49)
Updated by Dominic Cleal about 10 years ago
- Category set to Users, Roles and Permissions
Updated by Dominic Cleal about 10 years ago
- Related to Feature #4477: Improve permissions on resources in host creation/editing form added
Updated by Anonymous about 10 years ago
- Target version changed from 1.8.0 to 1.7.5
Updated by Eric Helms about 10 years ago
- Blocks Bug #5720: Roles: Add scopes to finds in converted controllers added
Updated by Anonymous about 10 years ago
- Target version changed from 1.7.5 to 1.7.4
Updated by Dominic Cleal about 10 years ago
- Related to Bug #7221: Edit organization displays associated resources for use w/o permissions added
Updated by Dominic Cleal about 10 years ago
- Related to Bug #7337: organizations UI does not filter resources to associate based upon RBAC added
Updated by Anonymous about 10 years ago
- Target version changed from 1.7.4 to 1.7.3
Updated by Dominic Cleal almost 10 years ago
- Target version changed from 1.7.3 to 1.7.2
Updated by Dominic Cleal over 8 years ago
- Status changed from Ready For Testing to New
- Assignee deleted (
Eric Helms) - Target version deleted (
1.7.2) - Pull request deleted (
https://github.com/Katello/katello/pull/4483)
Associated PR was closed.
Updated by Marek Hulán almost 8 years ago
- Related to Feature #7289: ACL who can add a host to hostgroup. added
Actions