External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-14 03:10:42 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5439 from AlanCoding/sys_aud_NT

Browse Source 
block system auditors from attaching notification templates
This commit is contained in:
Alan Rominger 2017-02-20 11:32:50 -05:00 committed by GitHub
commit 928d160f3d
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
awx/main/access.py
View File

@ -1229,6 +1229,13 @@ class JobTemplateAccess(BaseAccess):
"active_jobs": active_jobs})
return True
@check_superuser
def can_attach(self, obj, sub_obj, relationship, data, skip_sub_obj_read_check=False):
if isinstance(sub_obj, NotificationTemplate):
return self.check_related('organization', Organization, {}, obj=sub_obj, mandatory=True)
return super(JobTemplateAccess, self).can_attach(
obj, sub_obj, relationship, data, skip_sub_obj_read_check=skip_sub_obj_read_check)
class JobAccess(BaseAccess):
'''

12
awx/main/tests/functional/test_rbac_notifications.py
View File

@ -2,7 +2,8 @@ import pytest
from awx.main.access import (
NotificationTemplateAccess,
NotificationAccess
NotificationAccess,
JobTemplateAccess
)
@ -119,6 +120,15 @@ def test_notification_access_system_admin(notification, admin):
assert access.can_delete(notification)
@pytest.mark.django_db
def test_system_auditor_JT_attach(system_auditor, job_template, notification_template):
job_template.admin_role.members.add(system_auditor)
access = JobTemplateAccess(system_auditor)
assert not access.can_attach(
job_template, notification_template, 'notification_templates_success',
{'id': notification_template.id})
@pytest.mark.django_db
def test_notification_access_org_admin(notification, org_admin):
access = NotificationAccess(org_admin)