Bug 1435780

Summary: invalid values supplied when creating new policies using /api/policies doesn't result in error
Product: Red Hat CloudForms Management Engine Reporter: Martin Kourim <mkourim>
Component: APIAssignee: Joe Vlcek <jvlcek>
Status: CLOSED ERRATA QA Contact: Parthvi Vala <pvala>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.8.0CC: jhardy, jvlcek, obarenbo, pvala, simaishi, smallamp
Target Milestone: GA   
Target Release: 5.10.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: api:rest
Fixed In Version: 5.10.0.18 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-02-07 23:02:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Kourim 2017-03-24 18:14:10 UTC
Description of problem:
When creating new policy and "mode" is not a valid value (like "control" or "compliance"), or "towhat" is not a valid value (like "ContainerImage"), or "conditions_ids" are not references to to existing resources in /api/conditions - in all these cases, the creation of new policy succeeds.
On the other hand when references in "policy_contents" ("event_id" or "action_id") are not valid, the request fails as expected.


Version-Release number of selected component (if applicable):
5.8.0.7


How reproducible:
Very


Steps to Reproduce:
1. create new policy with invalid values, like:
POST /api/policies
{
  "action": "create",
  "resources": [{
    "name": "test policy foo",
    "description": "Desc foo",
    "mode": "bar",
    "towhat": "baz",
    "conditions_ids": [ 2000, 3000 ],
    "policy_contents": [{
      "event_id": 2,
      "actions": [ {"action_id": 1, "opts": { "qualifier": "failure" } } ]
    }]
  }]
}

Comment 2 Mooli Tayer 2017-03-28 09:09:19 UTC
Sorry Šimon, didn't notice you took that one. Reassigning

Comment 4 Šimon Lukašík 2017-06-06 14:14:55 UTC
So the validations for mode was done in https://github.com/ManageIQ/manageiq/pull/14519

However, we are still missing validations for towhat attribute.

Comment 6 CFME Bot 2018-09-28 18:41:11 UTC
New commit detected on ManageIQ/manageiq/master:

https://github.com/ManageIQ/manageiq/commit/d344e4307ed69e095d2c7869f12448d0b6e240a3
commit d344e4307ed69e095d2c7869f12448d0b6e240a3
Author:     Joe VLcek <jvlcek>
AuthorDate: Fri Sep 28 09:07:03 2018 -0400
Commit:     Joe VLcek <jvlcek>
CommitDate: Fri Sep 28 09:07:03 2018 -0400

    Validate towhat policy field

    https://bugzilla.redhat.com/show_bug.cgi?id=1435780

 app/models/miq_policy.rb | 11 +
 spec/models/miq_policy_spec.rb | 21 +
 2 files changed, 32 insertions(+)

Comment 7 CFME Bot 2018-10-01 16:57:20 UTC
New commit detected on ManageIQ/manageiq/hammer:

https://github.com/ManageIQ/manageiq/commit/28ab0177beb315a791af3d60a7ca5ae1cfc5c29a
commit 28ab0177beb315a791af3d60a7ca5ae1cfc5c29a
Author:     Brandon Dunne <brandondunne>
AuthorDate: Fri Sep 28 14:38:24 2018 -0400
Commit:     Brandon Dunne <brandondunne>
CommitDate: Fri Sep 28 14:38:24 2018 -0400

    Merge pull request #18032 from jvlcek/bz_1435780_tow_hat_validations

    Validate towhat policy field

    (cherry picked from commit 52704166f4dc48ccc2ced8c6bac0e8001e8d786f)

    https://bugzilla.redhat.com/show_bug.cgi?id=1435780

 app/models/miq_policy.rb | 11 +
 spec/models/miq_policy_spec.rb | 10 +
 2 files changed, 21 insertions(+)

Comment 8 Parthvi Vala 2019-01-04 06:43:51 UTC
FIXED. Verified on 5.10.0.30.

Request: POST /api/policies
Query: {
  "action": "create",
  "resources": [{
    "name": "test policy foo",
    "description": "Desc foo",
    "mode": "bar",
    "towhat": "baz",
    "conditions_ids": [ 2000, 3000 ],
    "policy_contents": [{
      "event_id": 2,
      "actions": [ {"action_id": 1, "opts": { "qualifier": "failure" } } ]
    }]
  }]
}

Response: {
	"error": {
		"kind": "bad_request",
		"message": "Could not create the new policy - Validation failed: MiqPolicy: Mode is not included in the list, MiqPolicy: Towhat is not included in the list",
		"klass": "Api::BadRequestError"
	}
}

Comment 10 errata-xmlrpc 2019-02-07 23:02:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:0212