See questions below...
On 11/15/2010 03:02 PM, ips wrote:
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java
| 23 +++++++---
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
| 2
2 files changed, 18 insertions(+), 7 deletions(-)
New commits:
commit 9315519acb694b4147a598f5258c5ffb95b7ce2e
Author: Ian Springer<ian.springer(a)redhat.com>
Date: Mon Nov 15 15:01:58 2010 -0500
don't attempt to fetch subjects or resourceGroups for a Role unless the
logged-in user has MANAGE_SECURITY
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/roles/RolesDataSource.java
@Override
@@ -99,6 +108,7 @@ public class RolesDataSource extends RPCDataSource<Role> {
...
- criteria.fetchResourceGroups(true);
criteria.fetchPermissions(true);
- criteria.fetchSubjects(true);
- // TODO: Uncomment this.
- //criteria.fetchLdapGroups(true);
+
+ if (this.globalPermissions.contains(Permission.MANAGE_SECURITY)) {
+ criteria.fetchSubjects(true);
+ criteria.fetchResourceGroups(true);
+ }
Fetching subjects should indeed be hidden behind MANAGE_SECURITY, but
should we allow a user with MANAGE_INVENTORY to be able to fetch the
corresponding groups for that role?
Looking further into this, I notice the same in RoleCriteria, where if
either of those fetches are specified then the user requires
MANAGE_SECURITY. Should the implementation instead be?
class RoleCriteria {
isSecurityManagerRequired() {
return this.fetchSubjects;
}
isInventoryManagerRequired() {
return this.fetchResourcesGroups;
}
}
return criteria;
}
diff --git
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
index adc834b..857ea0c 100644
---
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
+++
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/admin/users/UserEditView.java
@@ -126,7 +126,7 @@ public class UserEditView extends
AbstractRecordEditor<UsersDataSource> {
//
private boolean areRolesReadOnly(Record record) {
boolean isLdap =
Boolean.valueOf(record.getAttribute(UsersDataSource.Field.LDAP));
- return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN)
|| isLdap);
+ return (!hasManageSecurityPermission || (getRecordId() == SUBJECT_ID_RHQADMIN)
|| isLdap);
I agree that editing the subjects and/or permissions for that role
should be constrained to those with MANAGE_SECURITY, but should a user
with MANAGE_INVENTORY be able to edit the resource groups associated
with the role?