External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-23 16:47:45 -02:30
Code Issues Packages Projects Releases Wiki Activity

do not allow assignment of system roles or user.admin_role to teams

Browse Source
This commit is contained in:
Wayne Witzel III
2016-07-26 12:09:36 -04:00
parent 13bd9211ae
commit 9bad20cee3
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
awx/main/access.py
View File

@@ -720,7 +720,13 @@ class TeamAccess(BaseAccess):
def can_attach(self, obj, sub_obj, relationship, *args, **kwargs): def can_attach(self, obj, sub_obj, relationship, *args, **kwargs):
"""Reverse obj and sub_obj, defer to RoleAccess if this is an assignment """Reverse obj and sub_obj, defer to RoleAccess if this is an assignment
of a resource role to the team.""" of a resource role to the team."""
if isinstance(sub_obj, Role) and isinstance(sub_obj.content_object, ResourceMixin): if isinstance(sub_obj, Role):
if sub_obj.content_object is None:
raise PermissionDenied("The {} role cannot be assigned to a team".format(sub_obj.name))
elif isinstance(sub_obj.content_object, User):
raise PermissionDenied("The admin_role for a User cannot be assigned to a team")
if isinstance(sub_obj.content_object, ResourceMixin):
role_access = RoleAccess(self.user) role_access = RoleAccess(self.user)
return role_access.can_attach(sub_obj, obj, 'member_role.parents', return role_access.can_attach(sub_obj, obj, 'member_role.parents',
*args, **kwargs) *args, **kwargs)
@@ -728,7 +734,8 @@ class TeamAccess(BaseAccess):
*args, **kwargs) *args, **kwargs)
def can_unattach(self, obj, sub_obj, relationship, *args, **kwargs): def can_unattach(self, obj, sub_obj, relationship, *args, **kwargs):
if isinstance(sub_obj, Role) and isinstance(sub_obj.content_object, ResourceMixin): if isinstance(sub_obj, Role):
if isinstance(sub_obj.content_object, ResourceMixin):
role_access = RoleAccess(self.user) role_access = RoleAccess(self.user)
return role_access.can_unattach(sub_obj, obj, 'member_role.parents', return role_access.can_unattach(sub_obj, obj, 'member_role.parents',
*args, **kwargs) *args, **kwargs)