diff --git a/server/src/com/cloud/api/query/QueryManagerImpl.java b/server/src/com/cloud/api/query/QueryManagerImpl.java index f61d6736e92..c4068fd4915 100644 --- a/server/src/com/cloud/api/query/QueryManagerImpl.java +++ b/server/src/com/cloud/api/query/QueryManagerImpl.java @@ -3146,9 +3146,14 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q ex.addProxyObject(template.getUuid(), "templateId"); throw ex; } + if (caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN) { + Account template_acc = _accountMgr.getAccount(template.getAccountId()); + DomainVO domain = _domainDao.findById(template_acc.getDomainId()); + _accountMgr.checkAccess(caller, domain); - // if template is not public, perform permission check here - if (!template.isPublicTemplate() && caller.getType() != Account.ACCOUNT_TYPE_ADMIN) { + + }// if template is not public, perform permission check here + else if (!template.isPublicTemplate() && caller.getType() != Account.ACCOUNT_TYPE_ADMIN) { _accountMgr.checkAccess(caller, null, false, template); } diff --git a/ui/scripts/templates.js b/ui/scripts/templates.js index 5d52dfd1606..09d797d6a67 100755 --- a/ui/scripts/templates.js +++ b/ui/scripts/templates.js @@ -35,7 +35,7 @@ filters: { all: { preFilter: function(args) { - if (isAdmin()) //"listTemplates&templatefilter=all" only works for root-admin, but no domain-admin. Domain-admin is unable to see all templates until listTemplates API supports a new type of templatefilter for domain-admin to see all templates in his domain. + if (isAdmin()|| isDomainAdmin()) //"listTemplates&templatefilter=all" only for root-admin and domain-admin. Domain-admin is able to see all templates in his domain. return true; else return false; @@ -1914,7 +1914,7 @@ filters: { all: { preFilter: function(args) { - if (isAdmin()) //"listIsos&filter=all" only works for root-admin, but no domain-admin. Domain-admin is unable to see all Isos until listIsos API supports a new type of isofilter for domain-admin to see all Isos in his domain. + if (isAdmin()||isDomainAdmin()) //"listIsos&filter=all" works for root-admin and domain-admin. Domain-admin is able to see all Isos in his domain. return true; else return false;