diff --git a/server/src/com/cloud/template/TemplateAdapterBase.java b/server/src/com/cloud/template/TemplateAdapterBase.java index c5d4a6b7d15..fce2506983c 100755 --- a/server/src/com/cloud/template/TemplateAdapterBase.java +++ b/server/src/com/cloud/template/TemplateAdapterBase.java @@ -25,8 +25,8 @@ import org.apache.cloudstack.api.ApiConstants; import org.apache.cloudstack.api.command.user.iso.DeleteIsoCmd; import org.apache.cloudstack.api.command.user.iso.RegisterIsoCmd; import org.apache.cloudstack.api.command.user.template.DeleteTemplateCmd; -import org.apache.cloudstack.api.command.user.template.RegisterTemplateCmd; import org.apache.cloudstack.api.command.user.template.ExtractTemplateCmd; +import org.apache.cloudstack.api.command.user.template.RegisterTemplateCmd; import org.apache.cloudstack.engine.subsystem.api.storage.DataStore; import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager; import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao; @@ -46,6 +46,7 @@ import com.cloud.exception.ResourceAllocationException; import com.cloud.host.dao.HostDao; import com.cloud.hypervisor.Hypervisor.HypervisorType; import com.cloud.org.Grouping; +import com.cloud.projects.ProjectManager; import com.cloud.server.ConfigurationServer; import com.cloud.storage.GuestOS; import com.cloud.storage.Storage.ImageFormat; @@ -86,8 +87,9 @@ public abstract class TemplateAdapterBase extends AdapterBase implements Templat protected @Inject ResourceLimitService _resourceLimitMgr; protected @Inject DataStoreManager storeMgr; @Inject TemplateManager templateMgr; - @Inject ConfigurationServer _configServer; - + @Inject ConfigurationServer _configServer; + @Inject ProjectManager _projectMgr; + @Override public boolean stop() { return true; @@ -289,9 +291,16 @@ public abstract class TemplateAdapterBase extends AdapterBase implements Templat if ((template != null) && (!template.isPublicTemplate() && (account.getId() != template.getAccountId()) && (template.getTemplateType() != TemplateType.PERHOST))) { - throw new PermissionDeniedException(msg + ". Permission denied."); + //special handling for the project case + Account owner = _accountMgr.getAccount(template.getAccountId()); + if (owner.getType() == Account.ACCOUNT_TYPE_PROJECT) { + if (!_projectMgr.canAccessProjectAccount(account, owner.getId())) { + throw new PermissionDeniedException(msg + ". Permission denied. The caller can't access project's template"); + } + } else { + throw new PermissionDeniedException(msg + ". Permission denied."); + } } - } else { if ((vmInstanceCheck != null) && !_domainDao.isChildDomain(account.getDomainId(), vmInstanceCheck.getDomainId())) { throw new PermissionDeniedException(msg + ". Permission denied.");