External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-02-17 19:20:05 -03:30
Code Issues Packages Projects Releases Wiki Activity

restrict editing of orphan notification templates to superusers

Browse Source
This commit is contained in:
AlanCoding
2016-06-23 08:47:02 -04:00
parent a22cbebcb9
commit 2bebb76881
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
awx/main/access.py
View File

@@ -1369,14 +1369,15 @@ class NotificationTemplateAccess(BaseAccess):
@check_superuser @check_superuser
def can_change(self, obj, data): def can_change(self, obj, data):
if obj.organization is None:
# only superusers are allowed to edit orphan notification templates
return False
org_pk = get_pk_from_dict(data, 'organization') org_pk = get_pk_from_dict(data, 'organization')
if obj and org_pk and obj.organization.pk != org_pk: if obj and org_pk and obj.organization.pk != org_pk:
org = get_object_or_400(Organization, pk=org_pk) org = get_object_or_400(Organization, pk=org_pk)
if self.user not in org.admin_role: if self.user not in org.admin_role:
return False return False
if obj.organization is not None: return self.user in obj.organization.admin_role
return self.user in obj.organization.admin_role
return False
def can_admin(self, obj, data): def can_admin(self, obj, data):
return self.can_change(obj, data) return self.can_change(obj, data)

6
awx/main/tests/functional/test_rbac_notifications.py
View File

@@ -75,3 +75,9 @@ def test_notification_template_access_org_user(notification_template, user):
assert not access.can_read(notification_template) assert not access.can_read(notification_template)
assert not access.can_change(notification_template, None) assert not access.can_change(notification_template, None)
assert not access.can_delete(notification_template) assert not access.can_delete(notification_template)
@pytest.mark.django_db
def test_notificaiton_template_orphan_access_org_admin(notification_template, organization, org_admin):
notification_template.organization = None
access = NotificationTemplateAccess(org_admin)
assert not access.can_change(notification_template, {'organization': organization.id})