Actions
Bug #6760
openModels should ensure the authorization of associated objects before associating them to the model
Status:
New
Priority:
Normal
Assignee:
-
Category:
Users, Roles and Permissions
Target version:
-
Description
While this issue is systematic, I'll provide an example using domains and subnets to illustrate the problem.
As an admin:
1. Create a new domain: "example.org"
2. Create a User: "testuser"
3. Create a new Role: "Subnets Role"
4. Add a Filter to the Role with - Type: Subnets, Permissions: create_subnets, view_subnets
As testuser:
curl -u testuser:testuser -X POST -d '{"name": "subnet1", "network": "255.168.192.1", "mask": "255.255.255.0", "domains": [{"id": 1}]}' -H "Content-Type: application/json" http://10.13.129.41:3000/api/v2/subnets
Actions