Description of problem: Currently, the share export locations API is allowing any tenant to obtain export locations of any tenant's share. See the below URL: http://172.24.47.101:8786/v2/64350ec996cb4d91bfaa728fd7199313/shares/e93eb079-58fb-4758-9d95-a9a645b0250a/export_locations 64350ec996cb4d91bfaa728fd7199313: this is a non-admin tenant ID e93eb079-58fb-4758-9d95-a9a645b0250a: this is an admin's share ID This is because the API layer of the share export locations controller is going directly to the database to obtain the export locations of the supplied share ID. The ownership check is performed at the Share/API layer, which is not invoked in this workflow. Most surprisingly of all, the tempest tests: - test_export_locations.ExportLocationsTest.test_list_share_export_locations_by_member - test_export_locations.ExportLocationsTest.test_get_share_export_location_by_member ... should not be passing at all (and should be negative tests), as they are testing if a non-admin tenant is able to obtain and list export locations of a share created by the admin_client used by tempest.
Moving this to POST because the fixes indicated: https://review.opendev.org/714181 and https://review.opendev.org/710661 have merged upstream, and the manila tests package has been tagged on RDO: https://review.rdoproject.org/r/#/c/28654/ This should be part of the next downstream import into RHOSP
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenStack Platform 13 bug fix and enhancement advisory), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4387