[PATCH conductor 2/2] Bug 788465: Don't allow a Realm Admin to map to realms or providers without USE permission on the provider.

Scott Seago sseago at redhat.com
Thu Mar 8 06:17:18 UTC 2012


http://bugzilla.redhat.com/show_bug.cgi?id=788465

this commit must be applied on top of the comit for
	bug 800511: update roles list and default user roles
---
 src/app/controllers/realm_mappings_controller.rb |    6 ++++--
 src/app/controllers/realms_controller.rb         |    8 ++++++--
 src/app/views/realms/_mapping.html.haml          |   13 ++++++++-----
 src/features/realm.feature                       |   14 ++++++--------
 src/features/step_definitions/realm_steps.rb     |    6 ++++++
 5 files changed, 30 insertions(+), 17 deletions(-)

diff --git a/src/app/controllers/realm_mappings_controller.rb b/src/app/controllers/realm_mappings_controller.rb
index e57c8a0..41d53a1 100644
--- a/src/app/controllers/realm_mappings_controller.rb
+++ b/src/app/controllers/realm_mappings_controller.rb
@@ -53,9 +53,11 @@ class RealmMappingsController < ApplicationController
 
   def load_backend_targets
     @backend_targets = if @realm_target.realm_or_provider_type == 'Realm'
-      Realm.all
+      Provider.list_for_user(current_user, Privilege::USE).collect do |provider|
+        provider.realms
+      end.flatten
     else
-      Provider.list_for_user(current_user, Privilege::VIEW)
+      Provider.list_for_user(current_user, Privilege::USE)
     end
 
   end
diff --git a/src/app/controllers/realms_controller.rb b/src/app/controllers/realms_controller.rb
index e748999..86f5b6a 100644
--- a/src/app/controllers/realms_controller.rb
+++ b/src/app/controllers/realms_controller.rb
@@ -117,6 +117,7 @@ class RealmsController < ApplicationController
     @backend_provider_targets = @realm.realm_backend_targets.select { |x| x.realm_or_provider_type == 'Provider' }
 
     save_breadcrumb(realm_path(@realm), @realm.name)
+    load_backend_realms
 
     respond_to do |format|
       format.html { render :action => 'show' }
@@ -138,8 +139,11 @@ class RealmsController < ApplicationController
 
   def load_backend_realms
     #TODO: list only realms user has permission on
-    @backend_realms = Realm.all
-    @providers = Provider.list_for_user(current_user, Privilege::VIEW)
+    @backend_realms = Provider.list_for_user(current_user, Privilege::USE).collect do |provider|
+      provider.realms
+    end.flatten
+
+    @providers = Provider.list_for_user(current_user, Privilege::USE)
   end
 
   def load_realms
diff --git a/src/app/views/realms/_mapping.html.haml b/src/app/views/realms/_mapping.html.haml
index 36d1879..912cf81 100644
--- a/src/app/views/realms/_mapping.html.haml
+++ b/src/app/views/realms/_mapping.html.haml
@@ -1,8 +1,11 @@
 = form_tag multi_destroy_realm_mappings_path(:frontend_realm_id => @realm.id) do
   - if check_privilege(Privilege::MODIFY, Realm)
-    = link_to t('realms.mapping.mapping_realm'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Realm'), :class => "button", :id => 'mapping_to_realm_button'
-    = link_to t('realms.mapping.mapping_provider'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Provider'), :class => "button", :id => 'mapping_to_provider_button'
-    = submit_tag t('delete'), :id => 'delete_button', :class => 'button danger'
+    - if @backend_realms and !@backend_realms.empty?
+      = link_to t('realms.mapping.mapping_realm'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Realm'), :class => "button", :id => 'mapping_to_realm_button'
+    - if @providers and !@providers.empty?
+      = link_to t('realms.mapping.mapping_provider'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Provider'), :class => "button", :id => 'mapping_to_provider_button'
+    - if @realm.realm_backend_targets and !@realm.realm_backend_targets.empty?
+      = submit_tag t('delete'), :id => 'delete_mapping_button', :class => 'button danger', :confirm => t("realms.show.sure_to_delete")
 
 
   - unless @backend_provider_targets.empty?
@@ -10,7 +13,7 @@
     %table.flat.checkbox_table
       - @backend_provider_targets.each do |backend|
         %tr{:class => cycle('nostripe','stripe')}
-          %td= check_box_tag "id[]", backend.id, :id => "backend_id_#{backend.id}"
+          %td= check_box_tag "id[]", backend.id, false, :id => "backend_id_#{backend.id}"
           %td= backend.realm_or_provider.name
 
   - unless @backend_realm_targets.empty?
@@ -18,5 +21,5 @@
     %table.flat.checkbox_table
       - @backend_realm_targets.each do |backend|
         %tr{:class => cycle('nostripe','stripe')}
-          %td= check_box_tag "id[]", backend.id, :id => "backend_id_#{backend.id}"
+          %td= check_box_tag "id[]", backend.id, false, :id => "backend_id_#{backend.id}"
           %td= "#{backend.target_provider.name}: #{backend.target_realm.name}"
diff --git a/src/features/realm.feature b/src/features/realm.feature
index 6ec9f22..2dfc383 100644
--- a/src/features/realm.feature
+++ b/src/features/realm.feature
@@ -31,20 +31,18 @@ Feature: Manage Realms
     And there is a realm "testrealm1"
     And a provider "provider1" exists
     When I follow "testrealm1"
+    Then I should see "Add mapping to provider"
     And I follow "mapping_to_provider_button"
     Then I should be on the new realm mapping page
     When I press "realm_backend_target_submit"
     Then I should see a confirmation message
 
-  Scenario: Add a realm mapping w/o selecting backend target
+  Scenario: No 'add mapping to provider' if none exist
     Given I am on the realms page
     And there is a realm "testrealm1"
     And there is no provider
     When I follow "testrealm1"
-    And I follow "mapping_to_provider_button"
-    Then I should be on the new realm mapping page
-    And I press "realm_backend_target_submit"
-    Then I should see "Realm or provider can't be blank"
+    Then I should not see "Add mapping to provider"
 
   Scenario: Change the name
     Given I am on the realms page
@@ -80,10 +78,10 @@ Feature: Manage Realms
     And I should see an error message
 
   Scenario: Delete realm mapping without selecting one
-    Given I am on the realms page
-    And there is a realm "testrealm1"
+    Given a realm "testrealm1" exists mapped to a provider "provider1"
+    And I am on the realms page
     When I follow "testrealm1"
-    And I press "delete_button"
+    And I press "delete_mapping_button"
     Then I should see an error message
 
   Scenario: Search Realms
diff --git a/src/features/step_definitions/realm_steps.rb b/src/features/step_definitions/realm_steps.rb
index 5604a66..7c2dc62 100644
--- a/src/features/step_definitions/realm_steps.rb
+++ b/src/features/step_definitions/realm_steps.rb
@@ -21,6 +21,12 @@ Given /^a realm "([^"]*)" exists$/ do |realm_name|
   FrontendRealm.create(:name => realm_name)
 end
 
+Given /^a realm "([^"]*)" exists mapped to a provider "([^"]*)"$/ do |realm_name, provider_name|
+  @realm = FrontendRealm.find_or_create_by_name(:name => realm_name)
+  @provider = FactoryGirl.create(:mock_provider, :name => provider_name)
+  RealmBackendTarget.create!(:frontend_realm => @realm, :realm_or_provider => @provider)
+end
+
 Given /^a provider "([^"]*)" exists$/ do |name|
   FactoryGirl.create(:mock_provider, :name => name)
 end
-- 
1.7.6.4




More information about the aeolus-devel mailing list