etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed User type accounts being able to change resource limits of their own domain and account (#12046) 

Co-authored-by: Lucas Martins <56271185+lucas-a-martins@users.noreply.github.com>
This commit is contained in:
Erik Böck 2026-01-12 04:20:31 -03:00 committed by GitHub
parent 2811217578
commit 2358632253
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
View File

@ -903,6 +903,11 @@ public class ResourceLimitManagerImpl extends ManagerBase implements ResourceLim
public ResourceLimitVO updateResourceLimit(Long accountId, Long domainId, Integer typeId, Long max, String tag) {
Account caller = CallContext.current().getCallingAccount();
if (caller.getType().equals(Account.Type.NORMAL)) {
logger.info("Throwing exception because only root admins and domain admins are allowed to update resource limits.");
throw new PermissionDeniedException("Your account does not have the permission to update resource limits.");
}
if (max == null) {
max = (long)Resource.RESOURCE_UNLIMITED;
} else if (max < Resource.RESOURCE_UNLIMITED) {

1
server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
View File

@ -147,6 +147,7 @@ public class ResourceLimitManagerImplTest {
overrideDefaultConfigValue(ResourceLimitService.ResourceLimitStorageTags, "_defaultValue", StringUtils.join(storageTags, ","));
Account account = mock(Account.class);
when(account.getType()).thenReturn(Account.Type.ADMIN);
User user = mock(User.class);
CallContext.register(user, account);
}