Bug 1376641

Summary:	Tweaks to the dependent products RPC interface.
Product:	[Community] Bugzilla	Reporter:	Matt Tyson 🤬 <mtyson>
Component:	WebService	Assignee:	Matt Tyson 🤬 <mtyson>
Status:	CLOSED NEXTRELEASE	QA Contact:	tools-bugs <tools-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	5.0	CC:	huiwang, mtahir, qgong
Target Milestone:	5.0
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	5.0.3-rh8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-10-11 01:04:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Matt Tyson 🤬 2016-09-16 03:03:12 UTC

This is to tweak the Dependent Products RPC interface.

- Filter out products that the user is not allowed to see.

Users shouldn't be able to view, add or remove products they are not allowed to see.

- Open up DependentProducts.get to public users.

DependentProducts.get is needed to determine the list of products that can be entered as valid dependent products.  This RPC call should return a list of products that the user is allowed to see.

It should only return the manager contact email addresses if you are in the 'editcomponents' group.

Comment 1 Rony Gong 🔥 2016-10-10 07:37:12 UTC

Tested on QA environment(5.0.3-rh8)
Result: Pass
Steps:
1.public user couldn't get the unaccessable products by DependentProducts.get
2.none 'editcomponents' user couldn't get the manager contact email addresses
3.none 'editcomponents' user couldn't update DependentProducts