Bug 1594275

Summary: Users can see items which they don't have permissions/access to under services they own
Product: Red Hat CloudForms Management Engine Reporter: Satoe Imaishi <simaishi>
Component: APIAssignee: Milan Zázrivec <mzazrivec>
Status: CLOSED ERRATA QA Contact: Landon LaSmith <llasmith>
Severity: high Docs Contact:
Priority: high    
Version: 5.9.0CC: bascar, chhale, cpelland, dclarizi, duboyd, gtanzill, jamisonm, jritenou, lavenel, obarenbo, smallamp
Target Milestone: GAKeywords: ZStream
Target Release: 5.9.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 5.9.3.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1589266 Environment:
Last Closed: 2018-07-12 13:17:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: CFME Core Target Upstream Version:
Embargoed:
Bug Depends On: 1589266, 1595418    
Bug Blocks:    

Comment 2 CFME Bot 2018-06-22 14:00:31 UTC 
New commit detected on ManageIQ/manageiq-api/gaprindashvili:

https://github.com/ManageIQ/manageiq-api/commit/e225b647af5ad1dc104e7eab328fe7d1c00a6bc8
commit e225b647af5ad1dc104e7eab328fe7d1c00a6bc8
Author:     Gregg Tanzillo <gtanzill>
AuthorDate: Fri Jun 22 03:20:25 2018 -0400
Commit:     Gregg Tanzillo <gtanzill>
CommitDate: Fri Jun 22 03:20:25 2018 -0400

    Merge pull request #404 from mzazrivec/fix_rbac_in_vms_subcollection_for_services

    In list of services, fetch RBAC-filtered vms subcollection
    (cherry picked from commit a0ce54f2a19f7ad808e45d9b8f75733db0a40f79)

    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1594275

 app/controllers/api/subcollections/vms.rb | 1 +
 spec/requests/services_spec.rb | 21 +-
 2 files changed, 19 insertions(+), 3 deletions(-)
Comment 4 Landon LaSmith 2018-06-29 20:36:52 UTC 
Verification is currently blocked due to a bug while executing service requests in 5.9.3.3

https://bugzilla.redhat.com/show_bug.cgi?id=1595418
Comment 5 Landon LaSmith 2018-07-05 22:30:53 UTC 
VERIFIED in 5.9.3.4. While the total count of VMs order was displayed in the UI, a restricted user was only able to see ordered VMs that they had access to in the OPS and SSUI
Comment 7 errata-xmlrpc 2018-07-12 13:17:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2184