On 05/17/2012 09:40 AM, Mo Morsi wrote:
---
src/app/controllers/realms_controller.rb | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/src/app/controllers/realms_controller.rb
b/src/app/controllers/realms_controller.rb
index 86f5b6a..859a3a3 100644
--- a/src/app/controllers/realms_controller.rb
+++ b/src/app/controllers/realms_controller.rb
@@ -109,6 +109,7 @@ class RealmsController< ApplicationController
def show
@realm = FrontendRealm.find(params[:id])
+ require_privilege(Privilege::VIEW, @realm.provider)
This doesn't look
right to me. A FrontendRealm is not provider-specific
-- it's a conductor concept that gets mapped to one or more providers
(or back end realms on a provider). Back end realms (class Realm) are
provider-specific, but front-end realms (class FrontendRealm) are not
provider-specific
For now, we don't restrict permissions on realms (they don't even
include the PermissionedObject module)
@title = @realm.name
@tab_captions = [t('realms.tab_captions.properties'),
t('realms.tab_captions.mapping')]
@details_tab = params[:details_tab].blank? ? 'properties' :
params[:details_tab]
@@ -152,5 +153,6 @@ class RealmsController< ApplicationController
{:name => t("realms.index.realm_name"), :sort_attr => :name},
]
@realms = FrontendRealm.apply_filters(:preset_filter_id =>
params[:realms_preset_filter], :search_filter => params[:realms_search])
+ @realms.reject! { |realm| !check_privilege(Privilege::VIEW, realm.provider) }
end
end
Same comment here. Frontend Realms don't belong to providers, so we
can't filter on provider permissions.
NACK this patch --the two permission checks added here are 1)
unnecessary and 2) would probably result in an error when executed.
Scott