Project

General

Profile

Feature #6854

foreman api status is restricted for admin only

Added by Martin Ducar over 8 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Category:
API
Target version:
Difficulty:
easy
Triaged:
Bugzilla link:
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

Libraries for foreman api handling like https://pypi.python.org/pypi/python-foreman use /api/status url to determine which foreman version is installed, which in my opinion is quite good behaviour. But foreman requires admin rights to access such information, if you are trying to script this as normal user, this is not possible. I couldn't come up with any reasonable way why it should be restricted only to admin. Please elaborate, why is it the case or please fix it that this restriction in not present. Or that you can configure the rights. Thank you

Associated revisions

Revision 7267e023 (diff)
Added by Ondřej Pražák over 7 years ago

Fixes #6854 - Api status allowed for all users

Revision 14ce02a9 (diff)
Added by Ondřej Pražák over 7 years ago

Fixes #6854 - Api status allowed for all users

(cherry picked from commit 7267e023e6db34db8ebb3ba59f4be4b8d0e07624)

History

#1 Updated by Will Foster over 8 years ago

We've hit some situations where having /api/status improperly restricted to admin is causing some issues with general usage for non-admin users. Would love to see this fixed.

The file that maps permissions to URLs is app/services/foreman/access_permissions.rb and it just needs a new section.
You'd also need to add the permission name in db/seeds.d/03-permissions.rb.
I will take a stab at this when I find some time.

#2 Updated by Dominic Cleal over 8 years ago

  • Difficulty set to easy

#3 Updated by The Foreman Bot over 7 years ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/2557 added
  • Pull request deleted ()

#4 Updated by Ondřej Pražák over 7 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#5 Updated by Dominic Cleal over 7 years ago

  • Assignee set to Ondřej Pražák
  • Legacy Backlogs Release (now unused) set to 72

Also available in: Atom PDF