External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-07 17:37:37 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4483 from ryanpetrello/multi-owner

Browse Source 
fix bug where cred org permission was not checked

Reviewed-by: https://github.com/softwarefactory-project-zuul[bot]
This commit is contained in:
softwarefactory-project-zuul[bot]
2019-08-14 19:54:57 +00:00
committed by GitHub
parent 8df70f5412 4831cde39f
commit c35fbd6853
2 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
awx/main/access.py
View File

@@ -1168,15 +1168,20 @@ class CredentialAccess(BaseAccess):
return True return True
if data and data.get('user', None): if data and data.get('user', None):
user_obj = get_object_from_data('user', User, data) user_obj = get_object_from_data('user', User, data)
return bool(self.user == user_obj or UserAccess(self.user).can_admin(user_obj, None, check_setting=False)) if not bool(self.user == user_obj or UserAccess(self.user).can_admin(user_obj, None, check_setting=False)):
return False
if data and data.get('team', None): if data and data.get('team', None):
team_obj = get_object_from_data('team', Team, data) team_obj = get_object_from_data('team', Team, data)
return check_user_access(self.user, Team, 'change', team_obj, None) if not check_user_access(self.user, Team, 'change', team_obj, None):
return False
if data and data.get('organization', None): if data and data.get('organization', None):
organization_obj = get_object_from_data('organization', Organization, data) organization_obj = get_object_from_data('organization', Organization, data)
return any([check_user_access(self.user, Organization, 'change', organization_obj, None), if not any([check_user_access(self.user, Organization, 'change', organization_obj, None),
self.user in organization_obj.credential_admin_role]) self.user in organization_obj.credential_admin_role]):
return False return False
if not any(data.get(key, None) for key in ('user', 'team', 'organization')):
return False # you have to provide 1 owner field
return True
@check_superuser @check_superuser
def can_use(self, obj): def can_use(self, obj):

13
awx/main/tests/functional/test_rbac_credential.py
View File

@@ -74,6 +74,19 @@ def test_org_credential_access_admin(role_name, alice, org_credential):
'organization': org_credential.organization.pk}) 'organization': org_credential.organization.pk})
@pytest.mark.django_db
def test_org_and_user_credential_access(alice, organization):
"""Address specific bug where any user could make an org credential
in another org without any permissions to that org
"""
# Owner is both user and org, but org permission should still be checked
assert not CredentialAccess(alice).can_add({
'name': 'New credential.',
'user': alice.pk,
'organization': organization.pk
})
@pytest.mark.django_db @pytest.mark.django_db
def test_org_credential_access_member(alice, org_credential): def test_org_credential_access_member(alice, org_credential):
org_credential.admin_role.members.add(alice) org_credential.admin_role.members.add(alice)