Bug 843671 - internal server error when non-admin user click on providers
Summary: internal server error when non-admin user click on providers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: CloudForms Cloud Engine
Classification: Retired
Component: aeolus-conductor
Version: 1.1.0
Hardware: Unspecified
OS: Unspecified
urgent
medium
Target Milestone: rc
Assignee: Tzu-Mainn Chen
QA Contact: Rehana
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-27 02:06 UTC by Dave Johnson
Modified: 2012-12-04 15:15 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An ambiguous database column caused an internal server error when a standard user viewed the Providers page in Cloud Engine. This bug fix provides a specific column name. Users now view the Providers page without error.
Clone Of:
Environment:
Last Closed: 2012-12-04 15:15:31 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2012:1516 0 normal SHIPPED_LIVE CloudForms Cloud Engine 1.1 update 2012-12-04 19:51:45 UTC

Description Dave Johnson 2012-07-27 02:06:12 UTC
Description of problem:
=====================================
With a created user who only has the default permission of Global HWP User, when logged in as this user, if the user clicks on the Admin -> Providers, they hit a internal server error with the following PGError

PGError: ERROR: column reference "name" is ambiguous LINE 4: privileges.action='view') ORDER BY name ^ : SELECT "providers"."id" AS t0_r0, "providers"."name" AS t0_r1, "providers"."url" AS t0_r2, "providers"."lock_version" AS t0_r3, "providers"."created_at" AS t0_r4, "providers"."updated_at" AS t0_r5, "providers"."provider_type_id" AS t0_r6, "providers"."deltacloud_provider" AS t0_r7, "providers"."enabled" AS t0_r8, "providers"."available" AS t0_r9, "provider_types"."id" AS t1_r0, "provider_types"."name" AS t1_r1, "provider_types"."deltacloud_driver" AS t1_r2, "provider_types"."ssh_user" AS t1_r3, "provider_types"."home_dir" AS t1_r4, "provider_types"."created_at" AS t1_r5, "provider_types"."updated_at" AS t1_r6, "derived_permissions"."id" AS t2_r0, "derived_permissions"."permission_id" AS t2_r1, "derived_permissions"."role_id" AS t2_r2, "derived_permissions"."permission_object_id" AS t2_r3, "derived_permissions"."permission_object_type" AS t2_r4, "derived_permissions"."lock_version" AS t2_r5, "derived_permissions"."created_at" AS t2_r6, "derived_permissions"."updated_at" AS t2_r7, "derived_permissions"."entity_id" AS t2_r8, "entities"."id" AS t3_r0, "entities"."name" AS t3_r1, "entities"."entity_target_id" AS t3_r2, "entities"."entity_target_type" AS t3_r3, "entities"."lock_version" AS t3_r4, "entities"."created_at" AS t3_r5, "entities"."updated_at" AS t3_r6, "session_entities"."id" AS t4_r0, "session_entities"."user_id" AS t4_r1, "session_entities"."entity_id" AS t4_r2, "session_entities"."lock_version" AS t4_r3, "session_entities"."created_at" AS t4_r4, "session_entities"."updated_at" AS t4_r5, "session_entities"."session_id" AS t4_r6, "roles"."id" AS t5_r0, "roles"."name" AS t5_r1, "roles"."scope" AS t5_r2, "roles"."lock_version" AS t5_r3, "roles"."created_at" AS t5_r4, "roles"."updated_at" AS t5_r5, "roles"."assign_to_owner" AS t5_r6, "privileges"."id" AS t6_r0, "privileges"."role_id" AS t6_r1, "privileges"."target_type" AS t6_r2, "privileges"."action" AS t6_r3, "privileges"."lock_version" AS t6_r4, "privileges"."created_at" AS t6_r5, "privileges"."updated_at" AS t6_r6 FROM "providers" LEFT OUTER JOIN "provider_types" ON "provider_types"."id" = "providers"."provider_type_id" LEFT OUTER JOIN "derived_permissions" ON "derived_permissions"."permission_object_id" = "providers"."id" AND "derived_permissions"."permission_object_type" = 'Provider' LEFT OUTER JOIN "entities" ON "entities"."id" = "derived_permissions"."entity_id" LEFT OUTER JOIN "session_entities" ON "session_entities"."entity_id" = "entities"."id" LEFT OUTER JOIN "roles" ON "roles"."id" = "derived_permissions"."role_id" LEFT OUTER JOIN "privileges" ON "privileges"."role_id" = "roles"."id" WHERE (session_entities.user_id=5 and session_entities.session_id='e12315598708b267a2a4dbbcdcb1cb11' and privileges.target_type='Provider' and privileges.action='view') ORDER BY name 


Version-Release number of selected component (if applicable):
aeolus-conductor-0.11.0-0.20120725160025gita63325e.fc16.noarch


How reproducible:
100%

Steps to Reproduce:
1.  create new user
2.  leave default permissions
3.  login as new user
4.  click administer tab
5.  click cloud provider tab
  
Actual results:


Expected results:


Additional info:

Comment 3 Tzu-Mainn Chen 2012-08-10 15:56:07 UTC
Patch created:

http://lists.fedorahosted.org/pipermail/aeolus-devel/2012-August/011940.html

Comment 4 Tzu-Mainn Chen 2012-08-13 15:47:58 UTC
Pushed to master and 1.1:

commit cf54dba5ba78f9a542ff1f2f929483175a3be55d
BZ 843671 fix potentially ambiguous name column
Signed-off-by: Jason Guiditta <jguiditt>

commit a67b636c0310def8469a777e71dc756549bae95b
BZ 843671 fix potentially ambiguous name column
Signed-off-by: Jason Guiditta <jguiditt>
(cherry picked from commit cf54dba5ba78f9a542ff1f2f929483175a3be55d)

Comment 6 Aziza Karol 2012-09-17 06:54:28 UTC
No internal server error observed when non-admin user click on providers.

verified on:
rpm -qa | grep aeolus
aeolus-conductor-0.13.7-1.el6cf.noarch
aeolus-all-0.13.7-1.el6cf.noarch
rubygem-aeolus-cli-0.7.1-1.el6cf.noarch
aeolus-conductor-doc-0.13.7-1.el6cf.noarch
aeolus-configure-2.8.6-1.el6cf.noarch
rubygem-aeolus-image-0.3.0-12.el6.noarch
aeolus-conductor-daemons-0.13.7-1.el6cf.noarch

Comment 8 errata-xmlrpc 2012-12-04 15:15:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHEA-2012-1516.html


Note You need to log in before you can comment on or make changes to this bug.