[PATCH conductor 13/13] require Privilege::View on realm.provider when accessing realms

Scott Seago sseago at redhat.com
Fri May 18 03:09:56 UTC 2012


On 05/17/2012 09:40 AM, Mo Morsi wrote:
> ---
>   src/app/controllers/realms_controller.rb |    2 ++
>   1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/src/app/controllers/realms_controller.rb b/src/app/controllers/realms_controller.rb
> index 86f5b6a..859a3a3 100644
> --- a/src/app/controllers/realms_controller.rb
> +++ b/src/app/controllers/realms_controller.rb
> @@ -109,6 +109,7 @@ class RealmsController<  ApplicationController
>
>     def show
>       @realm = FrontendRealm.find(params[:id])
> +    require_privilege(Privilege::VIEW, @realm.provider)
This doesn't look right to me.  A FrontendRealm is not provider-specific 
-- it's a conductor concept that gets mapped to one or more providers 
(or back end realms on a provider). Back end realms (class Realm) are 
provider-specific, but front-end realms (class FrontendRealm) are not 
provider-specific

For now, we don't restrict permissions on realms (they don't even 
include the PermissionedObject module)
>       @title = @realm.name
>       @tab_captions = [t('realms.tab_captions.properties'), t('realms.tab_captions.mapping')]
>       @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
> @@ -152,5 +153,6 @@ class RealmsController<  ApplicationController
>         {:name =>  t("realms.index.realm_name"), :sort_attr =>  :name},
>       ]
>       @realms = FrontendRealm.apply_filters(:preset_filter_id =>  params[:realms_preset_filter], :search_filter =>  params[:realms_search])
> +    @realms.reject! { |realm| !check_privilege(Privilege::VIEW, realm.provider) }
>     end
>   end
Same comment here. Frontend Realms don't belong to providers, so we 
can't filter on provider permissions.

NACK this patch --the two permission checks added here are 1) 
unnecessary and 2) would probably result in an error when executed.

Scott




More information about the aeolus-devel mailing list