Bug 796047 – SecurityViolation error while accessing gpg key details with read only user

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 796047 - SecurityViolation error while accessing gpg key details with read only user

Summary:	SecurityViolation error while accessing gpg key details with read only user

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Satellite 6
Classification:	Red Hat
Component:	WebUI (Show other bugs)
Sub Component:
Version:	6.0.0
Hardware:	Unspecified Unspecified

Priority	high Severity medium (vote)
Target Milestone:	Unspecified
Target Release:	Unused
Assigned To:	Partha Aji
QA Contact:	Sachin Ghai
Docs Contact:

URL:
Whiteboard:
Keywords:	Triaged

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2012-02-22 02:23 EST by Sachin Ghai
Modified:	2013-03-27 16:56 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	When a read-only user attempted to view a GPG key in the graphical user interface, the body of the key was left blank. This was caused by a security violation error where the code had attempted to grant the user edit instead of read permissions. This is fixed in the current version. Users with read-only permission can now view GPG keys.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2012-12-04 14:42:17 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Complete error log from production.log (10.12 KB, application/octet-stream) 2012-02-22 02:24 EST, Sachin Ghai	no flags	Details
no details displayed on UI for gpg_keys using read only user (43.48 KB, image/png) 2012-02-22 02:26 EST, Sachin Ghai	no flags	Details
can see details of gpg-key using read only user (69.57 KB, image/png) 2012-10-03 04:28 EDT, Sachin Ghai	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2012:1543	normal	SHIPPED_LIVE	Important: CloudForms System Engine 1.1 update	2012-12-04 19:39:57 EST

Groups: None (edit)

Description Sachin Ghai 2012-02-22 02:23:55 EST

Description of problem:
I was trying to see the created gpgkey details in ACME_Corporation org. However when I click on 'Details' tab of gpg key, following backtrace generated in production.log. Nothing displayed on UI.

--
[ERROR: 2012-02-22 12:47:33 #30885] User reader is not allowed to access gpg_keys/edit
[ERROR: 2012-02-22 12:47:33 #30885] User reader is not allowed to access gpg_keys/edit
[ERROR: 2012-02-22 12:47:33 #30885] #<Errors::SecurityViolation: User reader is not allowed to access gpg_keys/edit>
[ERROR: 2012-02-22 12:47:33 #30885] /usr/share/katello/lib/authorization_rules.rb:31:in `authorize'
[ERROR: 2012-02-22 12:47:33 #30885] /usr/lib/ruby/gems/1.8/gems/activesupport-3.0.10/lib/active_support/callbacks.rb:458:in `_run__1167204022__process_action__1026853947__callbacks'
[ERROR: 2012-02-22 12:47:33 #30885] /usr/lib/ruby/gems/1.8/gems/activesupport-3.0.10/lib/active_support/callbacks.rb:221:in `_conditional_callback_around_2755'

----

Version-Release number of selected component (if applicable):
pulp-0.0.265-1.el6.noarch
katello-cli-0.1.54-2.el6.noarch
katello-0.1.238-4.el6.noarch


How reproducible:
always

Steps to Reproduce:
1. Add gpg keys in any org with admin user
2. create a user 'reader' with read only permissions
3. login with reader and check the 'details' of gpg_key
  
Actual results:
nothing displayed on UI, under details and 'Product & repositories' see the attached screenshot.

Long backtrace in production.log
Expected results:
details should be displayed properly without any error in production.log


Additional info:

Comment 1 Sachin Ghai 2012-02-22 02:24:39 EST

Created attachment 564851 [details]
Complete error log from production.log

Comment 2 Sachin Ghai 2012-02-22 02:26:08 EST

Created attachment 564852 [details]
no details displayed on UI for gpg_keys using read only user

Comment 4 Pavel Pokorny 2012-09-10 04:00:39 EDT

It was fixed long time ago in f61c2db

I tested it in Katello Version: 1.1.9-1.git.95.0ed1e6f.el6.

Comment 7 Sachin Ghai 2012-10-03 04:27:04 EDT

Verified with following CFSE build:

katello-glue-candlepin-1.1.12-12.el6cf.noarch
katello-qpid-client-key-pair-1.0-1.noarch
katello-all-1.1.12-12.el6cf.noarch
katello-cli-1.1.8-6.el6cf.noarch
katello-certs-tools-1.1.8-1.el6cf.noarch
katello-selinux-1.1.1-1.el6cf.noarch
katello-configure-1.1.9-6.el6cf.noarch
katello-candlepin-cert-key-pair-1.0-1.noarch
katello-cli-common-1.1.8-6.el6cf.noarch
katello-common-1.1.12-12.el6cf.noarch
katello-1.1.12-12.el6cf.noarch
katello-qpid-broker-key-pair-1.0-1.noarch
katello-glue-pulp-1.1.12-12.el6cf.noarch


I can see the created gpg_key details using read only user and no error generated under production.log.

Comment 8 Sachin Ghai 2012-10-03 04:28:06 EDT

Created attachment 620677 [details]
can see details of gpg-key using read only user

Comment 10 errata-xmlrpc 2012-12-04 14:42:17 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-1543.html

Note You need to log in before you can comment on or make changes to this bug.