Bug 1646435
| Summary: | Prevent Service Ordering directly from REST-API | ||
|---|---|---|---|
| Product: | Red Hat CloudForms Management Engine | Reporter: | Satoe Imaishi <simaishi> |
| Component: | Appliance | Assignee: | eclarizi |
| Status: | CLOSED ERRATA | QA Contact: | Parthvi Vala <pvala> |
| Severity: | medium | Docs Contact: | Red Hat CloudForms Documentation <cloudforms-docs> |
| Priority: | medium | ||
| Version: | 5.9.0 | CC: | abellott, bmidwood, dmetzger, eclarizi, ikaur, jprause, obarenbo, pvala, simaishi |
| Target Milestone: | GA | Keywords: | ZStream |
| Target Release: | 5.9.6 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 5.9.6.0 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1632416 | Environment: | |
| Last Closed: | 2018-12-13 15:15:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | CFME Core | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1632416 | ||
| Bug Blocks: | |||
|
Comment 2
CFME Bot
2018-11-05 16:46:44 UTC
New commits detected on ManageIQ/manageiq-api/gaprindashvili: https://github.com/ManageIQ/manageiq-api/commit/068184ec96943dcff4cab92dff2a4c60e2bc10fe commit 068184ec96943dcff4cab92dff2a4c60e2bc10fe Author: Brandon Dunne <brandondunne> AuthorDate: Mon Oct 22 11:49:56 2018 -0400 Commit: Brandon Dunne <brandondunne> CommitDate: Mon Oct 22 11:49:56 2018 -0400 Merge pull request #476 from eclarizio/dialog_ordering_security_issue Deny standalone service template ordering when product setting is enabled (cherry picked from commit 7343ad7cad22f24639a23ff3a9d6c5182d64172d) https://bugzilla.redhat.com/show_bug.cgi?id=1646435 app/controllers/api/mixins/service_templates.rb | 20 +- spec/requests/service_catalogs_spec.rb | 7 + spec/requests/service_templates_spec.rb | 13 +- 3 files changed, 36 insertions(+), 4 deletions(-) https://github.com/ManageIQ/manageiq-api/commit/a2572b3838432e92a573a348ac34da357edc3569 commit a2572b3838432e92a573a348ac34da357edc3569 Author: Brandon Dunne <brandondunne> AuthorDate: Wed Oct 31 15:00:05 2018 -0400 Commit: Brandon Dunne <brandondunne> CommitDate: Wed Oct 31 15:00:05 2018 -0400 Merge pull request #504 from eclarizio/dialog_ordering_security_issue_addendum Ensure ServiceTemplate ordering passes through the submit_workflow flag (cherry picked from commit bed1032d1e1fe54926e6717f116ff89cf5b55414) https://bugzilla.redhat.com/show_bug.cgi?id=1646435 app/controllers/api/mixins/service_templates.rb | 3 +- spec/requests/service_templates_spec.rb | 19 + 2 files changed, 21 insertions(+), 1 deletion(-) New commit detected on ManageIQ/manageiq-api/gaprindashvili: https://github.com/ManageIQ/manageiq-api/commit/1298a242bc3f5a4b9c7c4c90d005355cf772c1f2 commit 1298a242bc3f5a4b9c7c4c90d005355cf772c1f2 Author: Brandon Dunne <brandondunne> AuthorDate: Mon Oct 22 20:37:20 2018 -0400 Commit: Brandon Dunne <brandondunne> CommitDate: Mon Oct 22 20:37:20 2018 -0400 Merge pull request #498 from AparnaKarve/fix_order_service_template provide `service_template` to `orderable?` method (cherry picked from commit 41b245d34c08e9fe8b6c72f04ea697baeffc0e2c) https://bugzilla.redhat.com/show_bug.cgi?id=1646435 app/controllers/api/mixins/service_templates.rb | 4 +- 1 file changed, 2 insertions(+), 2 deletions(-) FIXED. Verified on 5.9.6.1.20181115153524_306f39f.
Steps taken to verify:
1. Go to `Configuration` and select `Advanced` tab.
2. Under the outermost `:product:`, set `:allow_api_service_ordering:` to `false`
3. Create a dialog, catalog and catalog item.
4. Send a request to order the service.
Request: POST /api/service_catalogs/:id/service_templates/:id
Query: { "action" : "order" }
Response: {
"error": {
"kind": "bad_request",
"message": "Service Template id:1 name:'catalog_item_1' cannot be ordered",
"klass": "Api::BadRequestError"
}
}
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:3816 |