etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

api: Update account type when updating account role (#6156) 

* api: Update account type when updating account role

* extract code to validate role change
This commit is contained in:
Pearl Dsilva 2022-04-06 09:20:56 +05:30 committed by GitHub
parent 306baea228
commit 9cc8da2a30
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
server/src/main/java/com/cloud/user/AccountManagerImpl.java
View File

@ -1181,6 +1181,18 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
return _userAccountDao.findById(userId);
}
private boolean isValidRoleChange(Account account, Role role) {
Long currentAccRoleId = account.getRoleId();
Role currentRole = roleService.findRole(currentAccRoleId);
if (role.getRoleType().ordinal() < currentRole.getRoleType().ordinal() && ((account.getType() == Account.Type.NORMAL && role.getRoleType().getAccountType().ordinal() > Account.Type.NORMAL.ordinal()) ||
account.getType().ordinal() > Account.Type.NORMAL.ordinal() && role.getRoleType().getAccountType().ordinal() < account.getType().ordinal() && role.getRoleType().getAccountType().ordinal() > 0)) {
throw new PermissionDeniedException(String.format("Unable to update account role to %s as you are " +
"attempting to escalate the account %s to account type %s which has higher privileges", role.getName(), account.getAccountName(), role.getRoleType().getAccountType().name()));
}
return true;
}
/**
* if there is any permission under the requested role that is not permitted for the caller, refuse
*/
@ -1897,7 +1909,10 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
"in the domain '" + domainId + "'.");
}
Role role = roleService.findRole(roleId);
isValidRoleChange(account, role);
acctForUpdate.setRoleId(roleId);
acctForUpdate.setType(role.getRoleType().getAccountType());
checkRoleEscalation(getCurrentCallingAccount(), acctForUpdate);
}