Red Hat Bugzilla – Bug 1594275
Users can see items which they don't have permissions/access to under services they own
Last modified: 2018-07-12 09:17:33 EDT
New commit detected on ManageIQ/manageiq-api/gaprindashvili: https://github.com/ManageIQ/manageiq-api/commit/e225b647af5ad1dc104e7eab328fe7d1c00a6bc8 commit e225b647af5ad1dc104e7eab328fe7d1c00a6bc8 Author: Gregg Tanzillo <gtanzill@redhat.com> AuthorDate: Fri Jun 22 03:20:25 2018 -0400 Commit: Gregg Tanzillo <gtanzill@redhat.com> CommitDate: Fri Jun 22 03:20:25 2018 -0400 Merge pull request #404 from mzazrivec/fix_rbac_in_vms_subcollection_for_services In list of services, fetch RBAC-filtered vms subcollection (cherry picked from commit a0ce54f2a19f7ad808e45d9b8f75733db0a40f79) Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1594275 app/controllers/api/subcollections/vms.rb | 1 + spec/requests/services_spec.rb | 21 +- 2 files changed, 19 insertions(+), 3 deletions(-)
Verification is currently blocked due to a bug while executing service requests in 5.9.3.3 https://bugzilla.redhat.com/show_bug.cgi?id=1595418
VERIFIED in 5.9.3.4. While the total count of VMs order was displayed in the UI, a restricted user was only able to see ordered VMs that they had access to in the OPS and SSUI
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:2184