[PATCH conductor 2/2] Bug 788465: Don't allow a Realm Admin to map to realms or providers without USE permission on the provider.
Scott Seago
sseago at redhat.com
Thu Mar 8 06:17:18 UTC 2012
http://bugzilla.redhat.com/show_bug.cgi?id=788465
this commit must be applied on top of the comit for
bug 800511: update roles list and default user roles
---
src/app/controllers/realm_mappings_controller.rb | 6 ++++--
src/app/controllers/realms_controller.rb | 8 ++++++--
src/app/views/realms/_mapping.html.haml | 13 ++++++++-----
src/features/realm.feature | 14 ++++++--------
src/features/step_definitions/realm_steps.rb | 6 ++++++
5 files changed, 30 insertions(+), 17 deletions(-)
diff --git a/src/app/controllers/realm_mappings_controller.rb b/src/app/controllers/realm_mappings_controller.rb
index e57c8a0..41d53a1 100644
--- a/src/app/controllers/realm_mappings_controller.rb
+++ b/src/app/controllers/realm_mappings_controller.rb
@@ -53,9 +53,11 @@ class RealmMappingsController < ApplicationController
def load_backend_targets
@backend_targets = if @realm_target.realm_or_provider_type == 'Realm'
- Realm.all
+ Provider.list_for_user(current_user, Privilege::USE).collect do |provider|
+ provider.realms
+ end.flatten
else
- Provider.list_for_user(current_user, Privilege::VIEW)
+ Provider.list_for_user(current_user, Privilege::USE)
end
end
diff --git a/src/app/controllers/realms_controller.rb b/src/app/controllers/realms_controller.rb
index e748999..86f5b6a 100644
--- a/src/app/controllers/realms_controller.rb
+++ b/src/app/controllers/realms_controller.rb
@@ -117,6 +117,7 @@ class RealmsController < ApplicationController
@backend_provider_targets = @realm.realm_backend_targets.select { |x| x.realm_or_provider_type == 'Provider' }
save_breadcrumb(realm_path(@realm), @realm.name)
+ load_backend_realms
respond_to do |format|
format.html { render :action => 'show' }
@@ -138,8 +139,11 @@ class RealmsController < ApplicationController
def load_backend_realms
#TODO: list only realms user has permission on
- @backend_realms = Realm.all
- @providers = Provider.list_for_user(current_user, Privilege::VIEW)
+ @backend_realms = Provider.list_for_user(current_user, Privilege::USE).collect do |provider|
+ provider.realms
+ end.flatten
+
+ @providers = Provider.list_for_user(current_user, Privilege::USE)
end
def load_realms
diff --git a/src/app/views/realms/_mapping.html.haml b/src/app/views/realms/_mapping.html.haml
index 36d1879..912cf81 100644
--- a/src/app/views/realms/_mapping.html.haml
+++ b/src/app/views/realms/_mapping.html.haml
@@ -1,8 +1,11 @@
= form_tag multi_destroy_realm_mappings_path(:frontend_realm_id => @realm.id) do
- if check_privilege(Privilege::MODIFY, Realm)
- = link_to t('realms.mapping.mapping_realm'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Realm'), :class => "button", :id => 'mapping_to_realm_button'
- = link_to t('realms.mapping.mapping_provider'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Provider'), :class => "button", :id => 'mapping_to_provider_button'
- = submit_tag t('delete'), :id => 'delete_button', :class => 'button danger'
+ - if @backend_realms and !@backend_realms.empty?
+ = link_to t('realms.mapping.mapping_realm'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Realm'), :class => "button", :id => 'mapping_to_realm_button'
+ - if @providers and !@providers.empty?
+ = link_to t('realms.mapping.mapping_provider'), new_realm_mapping_path(:frontend_realm_id => @realm.id, :realm_or_provider_type => 'Provider'), :class => "button", :id => 'mapping_to_provider_button'
+ - if @realm.realm_backend_targets and !@realm.realm_backend_targets.empty?
+ = submit_tag t('delete'), :id => 'delete_mapping_button', :class => 'button danger', :confirm => t("realms.show.sure_to_delete")
- unless @backend_provider_targets.empty?
@@ -10,7 +13,7 @@
%table.flat.checkbox_table
- @backend_provider_targets.each do |backend|
%tr{:class => cycle('nostripe','stripe')}
- %td= check_box_tag "id[]", backend.id, :id => "backend_id_#{backend.id}"
+ %td= check_box_tag "id[]", backend.id, false, :id => "backend_id_#{backend.id}"
%td= backend.realm_or_provider.name
- unless @backend_realm_targets.empty?
@@ -18,5 +21,5 @@
%table.flat.checkbox_table
- @backend_realm_targets.each do |backend|
%tr{:class => cycle('nostripe','stripe')}
- %td= check_box_tag "id[]", backend.id, :id => "backend_id_#{backend.id}"
+ %td= check_box_tag "id[]", backend.id, false, :id => "backend_id_#{backend.id}"
%td= "#{backend.target_provider.name}: #{backend.target_realm.name}"
diff --git a/src/features/realm.feature b/src/features/realm.feature
index 6ec9f22..2dfc383 100644
--- a/src/features/realm.feature
+++ b/src/features/realm.feature
@@ -31,20 +31,18 @@ Feature: Manage Realms
And there is a realm "testrealm1"
And a provider "provider1" exists
When I follow "testrealm1"
+ Then I should see "Add mapping to provider"
And I follow "mapping_to_provider_button"
Then I should be on the new realm mapping page
When I press "realm_backend_target_submit"
Then I should see a confirmation message
- Scenario: Add a realm mapping w/o selecting backend target
+ Scenario: No 'add mapping to provider' if none exist
Given I am on the realms page
And there is a realm "testrealm1"
And there is no provider
When I follow "testrealm1"
- And I follow "mapping_to_provider_button"
- Then I should be on the new realm mapping page
- And I press "realm_backend_target_submit"
- Then I should see "Realm or provider can't be blank"
+ Then I should not see "Add mapping to provider"
Scenario: Change the name
Given I am on the realms page
@@ -80,10 +78,10 @@ Feature: Manage Realms
And I should see an error message
Scenario: Delete realm mapping without selecting one
- Given I am on the realms page
- And there is a realm "testrealm1"
+ Given a realm "testrealm1" exists mapped to a provider "provider1"
+ And I am on the realms page
When I follow "testrealm1"
- And I press "delete_button"
+ And I press "delete_mapping_button"
Then I should see an error message
Scenario: Search Realms
diff --git a/src/features/step_definitions/realm_steps.rb b/src/features/step_definitions/realm_steps.rb
index 5604a66..7c2dc62 100644
--- a/src/features/step_definitions/realm_steps.rb
+++ b/src/features/step_definitions/realm_steps.rb
@@ -21,6 +21,12 @@ Given /^a realm "([^"]*)" exists$/ do |realm_name|
FrontendRealm.create(:name => realm_name)
end
+Given /^a realm "([^"]*)" exists mapped to a provider "([^"]*)"$/ do |realm_name, provider_name|
+ @realm = FrontendRealm.find_or_create_by_name(:name => realm_name)
+ @provider = FactoryGirl.create(:mock_provider, :name => provider_name)
+ RealmBackendTarget.create!(:frontend_realm => @realm, :realm_or_provider => @provider)
+end
+
Given /^a provider "([^"]*)" exists$/ do |name|
FactoryGirl.create(:mock_provider, :name => name)
end
--
1.7.6.4
More information about the aeolus-devel
mailing list