etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adding Operate access check at service layer, since we are not checking access on the command parameter here

This commit is contained in:
Prachi Damle 2014-03-03 13:34:26 -08:00
parent e5d722654a
commit a837ac8873
2 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
api/src/org/apache/cloudstack/api/command/user/securitygroup/RevokeSecurityGroupEgressCmd.java
View File

@ -19,8 +19,6 @@ package org.apache.cloudstack.api.command.user.securitygroup;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.IAMEntityType;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiCommandJobType;
import org.apache.cloudstack.api.ApiConstants;
@ -47,7 +45,6 @@ public class RevokeSecurityGroupEgressCmd extends BaseAsyncCmd {
// ////////////// API parameters /////////////////////
// ///////////////////////////////////////////////////
@ACL(accessType = AccessType.OperateEntry, pointerToEntity = "securityGroupId")
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, required = true, description = "The ID of the egress rule", entityType=SecurityGroupRuleResponse.class)
private Long id;

3
server/src/com/cloud/network/security/SecurityGroupManagerImpl.java
View File

@ -43,6 +43,7 @@ import javax.naming.ConfigurationException;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.log4j.Logger;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.command.user.securitygroup.AuthorizeSecurityGroupEgressCmd;
import org.apache.cloudstack.api.command.user.securitygroup.AuthorizeSecurityGroupIngressCmd;
import org.apache.cloudstack.api.command.user.securitygroup.CreateSecurityGroupCmd;
@ -812,7 +813,7 @@ public class SecurityGroupManagerImpl extends ManagerBase implements SecurityGro
// Check permissions
SecurityGroup securityGroup = _securityGroupDao.findById(rule.getSecurityGroupId());
_accountMgr.checkAccess(caller, null, true, securityGroup);
_accountMgr.checkAccess(caller, AccessType.OperateEntry, true, securityGroup);
return Transaction.execute(new TransactionCallback<Boolean>() {
@Override