External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-29 15:24:42 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4753 from AlanCoding/WJ_delete

Browse Source 
Limit workflow job delete access to org admin
This commit is contained in:
Alan Rominger 2017-01-18 16:09:30 -05:00 committed by GitHub
commit f5d4cbb482
2 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
awx/main/access.py
View File

@ -1625,11 +1625,11 @@ class WorkflowJobAccess(BaseAccess):
def can_change(self, obj, data): def can_change(self, obj, data):
return False return False
@check_superuser
def can_delete(self, obj): def can_delete(self, obj):
if obj.workflow_job_template is None: return (obj.workflow_job_template and
# only superusers can delete orphaned workflow jobs obj.workflow_job_template.organization and
return self.user.is_superuser self.user in obj.workflow_job_template.organization.admin_role)
return self.user in obj.workflow_job_template.admin_role
def get_method_capability(self, method, obj, parent_obj): def get_method_capability(self, method, obj, parent_obj):
if method == 'start': if method == 'start':

10
awx/main/tests/functional/test_rbac_workflow.py
View File

@ -86,11 +86,15 @@ class TestWorkflowJobTemplateNodeAccess:
@pytest.mark.django_db @pytest.mark.django_db
class TestWorkflowJobAccess: class TestWorkflowJobAccess:
def test_wfjt_admin_delete(self, wfjt, workflow_job, rando): def test_org_admin_can_delete_workflow_job(self, workflow_job, org_admin):
wfjt.admin_role.members.add(rando) access = WorkflowJobAccess(org_admin)
access = WorkflowJobAccess(rando)
assert access.can_delete(workflow_job) assert access.can_delete(workflow_job)
def test_wfjt_admin_can_delete_workflow_job(self, workflow_job, rando):
workflow_job.workflow_job_template.admin_role.members.add(rando)
access = WorkflowJobAccess(rando)
assert not access.can_delete(workflow_job)
def test_cancel_your_own_job(self, wfjt, workflow_job, rando): def test_cancel_your_own_job(self, wfjt, workflow_job, rando):
wfjt.execute_role.members.add(rando) wfjt.execute_role.members.add(rando)
workflow_job.created_by = rando workflow_job.created_by = rando