Hide Forgot
Description of problem: API is missing the role identifying for reading virtual_templates resources. this means that a user with a role without the Show Virtual Templates access can still fetch an individual virtual template. Version-Release number of selected component (if applicable): 5.7 How reproducible: Always Steps to Reproduce: 1.Setup user with Role with Access Rules for all Virtual Machines -> Template Access Rules -> Virtual Templates -> Show Virtual Templates UNCHECKED 2. GET /api/virtual_templates/:id Actual results: Successful return of the resource Expected results: 403/Forbidden Additional info:
https://github.com/ManageIQ/manageiq/pull/12452
New commit detected on ManageIQ/manageiq/master: https://github.com/ManageIQ/manageiq/commit/6e3b51a3fad3c390c87d5e15c0baabbfb233d00e commit 6e3b51a3fad3c390c87d5e15c0baabbfb233d00e Author: Alberto Bellotti <abellott> AuthorDate: Fri Nov 4 17:07:50 2016 -0400 Commit: Alberto Bellotti <abellott> CommitDate: Tue Nov 8 10:13:39 2016 -0500 Was missing a role identifier for reading virtual_templates resources. - Added the virtual_template_show role identifier for reading /api/virtual_templates/:id resources - Added specs https://bugzilla.redhat.com/show_bug.cgi?id=1392612 config/api.yml | 4 ++++ spec/requests/api/virtual_templates_spec.rb | 23 +++++++++++++++++++++++ 2 files changed, 27 insertions(+)
New commit detected on ManageIQ/manageiq/euwe: https://github.com/ManageIQ/manageiq/commit/b5eb7caa29c3659a6888de36946c4b01a77adb73 commit b5eb7caa29c3659a6888de36946c4b01a77adb73 Author: Gregg Tanzillo <gtanzill> AuthorDate: Thu Nov 10 10:21:57 2016 -0500 Commit: Oleg Barenboim <chessbyte> CommitDate: Thu Nov 10 15:39:00 2016 -0500 Merge pull request #12452 from abellotti/api_virtual_template_resource_read_role Was missing a role identifier for reading virtual_templates resources. (cherry picked from commit 1a0ec9c8cb4304fe89e5c6daef39a632e14699a8) https://bugzilla.redhat.com/show_bug.cgi?id=1392612 config/api.yml | 4 ++++ spec/requests/api/virtual_templates_spec.rb | 23 +++++++++++++++++++++++ 2 files changed, 27 insertions(+)
Verified by following "Steps to Reproduce". Result: { "error": { "kind": "forbidden", "message": "Use of the read action is forbidden", "klass": "Api::ForbiddenError" } }