Bug 781460

Summary: [RBAC] manipulating URL allows access to systems in environments w/o permissions
Product: Red Hat Satellite Reporter: Tom McKay <tomckay>
Component: WebUIAssignee: Partha Aji <paji>
Status: CLOSED CURRENTRELEASE QA Contact: Katello QA List <katello-qa-list>
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.0.0CC: mmccune, omaciel
Target Milestone: UnspecifiedKeywords: Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-22 18:19:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 747354    

Description Tom McKay 2012-01-13 14:24:11 UTC
After creating a role for "Read System in Environment, PRODUCTION" and assigning that role to a new user, login as that user. Visiting Systems By Environment page shows the env selector with only PRODUCTION clickable which is correct. Note the URL in the browser, though, and change the trailing env_id param to another number. Reload the page: Systems in the new env_id are displayed (though the env selector still is locked to PRODUCTION).

Comment 2 Mike McCune 2012-01-26 19:08:23 UTC
mass ON_QA move

Comment 4 Og Maciel 2012-02-13 18:30:32 UTC
Verified on:
* candlepin-0.5.18-1.el6.noarch
* candlepin-tomcat6-0.5.18-1.el6.noarch
* katello-0.1.229-2.el6.noarch
* katello-all-0.1.229-2.el6.noarch
* katello-certs-tools-1.0.2-2.el6.noarch
* katello-cli-0.1.44-2.el6.noarch
* katello-cli-common-0.1.44-2.el6.noarch
* katello-common-0.1.229-2.el6.noarch
* katello-configure-0.1.61-2.el6.noarch
* katello-glue-candlepin-0.1.229-2.el6.noarch
* katello-glue-foreman-0.1.229-2.el6.noarch
* katello-glue-pulp-0.1.229-2.el6.noarch
* katello-httpd-ssl-key-pair-1.0-1.noarch
* katello-qpid-broker-key-pair-1.0-1.noarch
* katello-repos-0.1.5-1.el6.noarch
* katello-selinux-0.1.3-1.el6.noarch
* katello-trusted-ssl-cert-1.0-1.noarch
* pulp-0.0.265-1.el6.noarch
* pulp-common-0.0.265-1.el6.noarch
* pulp-selinux-server-0.0.265-1.el6.noarch