Bug 744670 - import_cluster ACL not enforced.
Summary: import_cluster ACL not enforced.
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: luci
Version: 6.2
Hardware: Unspecified
OS: Unspecified
medium
high
Target Milestone: rc
: ---
Assignee: Ryan McCabe
QA Contact: Cluster QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-10-10 05:46 UTC by Marius Rieder
Modified: 2011-10-18 18:56 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-18 18:56:04 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Marius Rieder 2011-10-10 05:46:46 UTC
Description of problem:

If a unprivileged user try to import a new cluster, he get a Error 403. However the cluster is created never the less.

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 6.2 Beta (Santiago)
luci-0.23.0-29.el6.x86_64


How reproducible:

Steps to Reproduce:
1. Install cluster suit and luci
2. Create a cluster in luci
3. Delete the cluster in luci
4. Create a new local system user
5. Login to luci as this new user.
6. Import the cluster created before.
  
Actual results:
You get a "Error 403" but the cluster is importer.

Expected results:
You get a "Error 403" instead of the import wizard and the cluster is not imported.

Additional info:

Comment 2 Ryan McCabe 2011-10-12 03:59:14 UTC
I can't reproduce this. When I try to do this, I get the error 403, and the cluster is not added.

Comment 3 RHEL Program Management 2011-10-18 18:40:13 UTC
Since RHEL 6.2 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.

Comment 4 Lon Hohberger 2011-10-18 18:55:39 UTC
I can't reproduce this either; I logged in as a non-root user, clicked 'homebase', then 'manage clusters', clicked 'add cluster', filled the form out, clicked submit and then was presented with:

====
[X] At least one of the following predicates must be met: The current user must be "root", The member must belong to at least one of the following groups: managers, import_cluster

Error 403

We're sorry but we weren't able to process this request.
====

Comment 5 Lon Hohberger 2011-10-18 18:56:57 UTC
[root@snap ~]# rpm -q luci
luci-0.23.0-32.el6.x86_64


Note You need to log in before you can comment on or make changes to this bug.