External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-06-27 17:38:02 -02:30
Code Issues Packages Projects Releases Wiki Activity

Loosen up team EE restrictions (#15384)

Browse Source 
* Try to loosen up team EE restrictions

* Fix missed permission case of nulling EE org
This commit is contained in:
Alan Rominger
2024-07-22 14:51:32 -04:00
committed by GitHub
parent fa670e2d7f
commit 59f61517d4
3 changed files with 22 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
awx/main/access.py
View File

@@ -1400,7 +1400,9 @@ class ExecutionEnvironmentAccess(BaseAccess):
def filtered_queryset(self):
return ExecutionEnvironment.objects.filter(
Q(organization__in=Organization.accessible_pk_qs(self.user, 'read_role')) | Q(organization__isnull=True)
Q(organization__in=Organization.accessible_pk_qs(self.user, 'read_role'))
| Q(organization__isnull=True)
| Q(id__in=ExecutionEnvironment.access_ids_qs(self.user, 'change'))
).distinct()
@check_superuser
@@ -1419,7 +1421,13 @@ class ExecutionEnvironmentAccess(BaseAccess):
else:
if self.user not in obj.organization.execution_environment_admin_role:
raise PermissionDenied
return self.check_related('organization', Organization, data, obj=obj, role_field='execution_environment_admin_role')
if not self.check_related('organization', Organization, data, obj=obj, role_field='execution_environment_admin_role'):
return False
# Special case that check_related does not catch, org users can not remove the organization from the EE
if data and ('organization' in data or 'organization_id' in data):
if (not data.get('organization')) and (not data.get('organization_id')):
return False
return True
def can_delete(self, obj):
if obj.managed: