Repository navigation
Allow project admin to update template/ISO permissions in projects - #14510
Open
DaanHoogland wants to merge 1 commit into
Open
DaanHoogland wants to merge 1 commit into
DaanHoogland wants to merge 1 commit into
Conversation
…oject-owned templates Project-owned templates can only have their permissions (ispublic, isextractable, launch permissions) changed by a CloudStack admin or by an account whose id equals the template's owner account id. For a project-owned template the owner is the project's pseudo-account, which no human account id can ever equal, so every project member - including the Project Admin who originally registered the template - was rejected by updateTemplateOrIsoPermissions(). Fix: compute whether the caller is the Project Admin of the owning project via the existing ProjectManager.canModifyProjectAccount() check (the same check DomainChecker already uses for AccessType.ModifyProject) and let that satisfy both ownership checks in TemplateManagerImpl.updateTemplateOrIsoPermissions(), alongside the existing owner/admin checks. Added TemplateManagerImplTest#testUpdateTemplatePermissionsAllowsProjectAdminToActAsOwner, which fails with the old code (InvalidParameterValueException) and passes with the fix. Fixes CS-3498 / apache#14174
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 4.20 #14510 +/- ##
============================================
+ Coverage 16.41% 16.43% +0.01%
- Complexity 13657 13677 +20
============================================
Files 5669 5669
Lines 501628 501632 +4
Branches 60942 60940 -2
============================================
+ Hits 82336 82437 +101
+ Misses 410064 409937 -127
- Partials 9228 9258 +30
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
Author
|
@blueorangutan package |
|
@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19800 |
Contributor
Author
|
@blueorangutan test keepEnv |
|
@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests |
|
[SF] Trillian Build Failed (tid-17313) |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Project-owned templates can only have their permissions (ispublic, isextractable, launch permissions) changed by a CloudStack admin or by an account whose id equals the template's owner account id. For a project-owned template the owner is the project's pseudo-account, which no human account id can ever equal, so every project member - including the Project Admin who originally registered the template - was rejected by updateTemplateOrIsoPermissions().
Fix: compute whether the caller is the Project Admin of the owning project via the existing ProjectManager.canModifyProjectAccount() check (the same check DomainChecker already uses for AccessType.ModifyProject) and let that satisfy both ownership checks in
TemplateManagerImpl.updateTemplateOrIsoPermissions(), alongside the existing owner/admin checks.
Added TemplateManagerImplTest#testUpdateTemplatePermissionsAllowsProjectAdminToActAsOwner, which fails with the old code (InvalidParameterValueException) and passes with the fix.
Fixes #14174
Description
This PR...
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?