shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-01-21 18:03:38 +03:00
Code Releases Wiki Activity

B #6315: Fix remove of restricted vector attributes (#2731)

Browse Source
This commit is contained in:
Pavel Czerný 2023-09-18 16:17:59 +02:00 committed by GitHub
parent f5d6f11730
commit 534823e7f1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 29 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/GroupTemplate.h
View File

@ -32,9 +32,9 @@ public:
// -------------------------------------------------------------------------
// Restricted attributes interface implementation
// -------------------------------------------------------------------------
bool check_restricted(std::string& rs_attr, const Template* base) override
bool check_restricted(std::string& rs_attr, const Template* base, bool append) override
{
return Template::check_restricted(rs_attr, base, restricted);
return Template::check_restricted(rs_attr, base, restricted, append);
}
bool check_restricted(std::string& rs_attr) override

4
include/ImageTemplate.h
View File

@ -53,9 +53,9 @@ public:
// -------------------------------------------------------------------------
// Restricted attributes interface implementation
// -------------------------------------------------------------------------
bool check_restricted(std::string& rs_attr, const Template* base) override
bool check_restricted(std::string& rs_attr, const Template* base, bool append) override
{
return Template::check_restricted(rs_attr, base, restricted);
return Template::check_restricted(rs_attr, base, restricted, append);
}
bool check_restricted(std::string& rs_attr) override

4
include/Template.h
View File

@ -460,7 +460,7 @@ public:
* The version of this method without base template just look for any
* restricted attribute.
*/
virtual bool check_restricted(std::string& rs_attr, const Template* base)
virtual bool check_restricted(std::string& rs_attr, const Template* base, bool append)
{
return false;
}
@ -549,7 +549,7 @@ protected:
* in the template
*/
bool check_restricted(std::string& rs_attr, const Template* base,
const std::map<std::string, std::set<std::string> >& ras);
const std::map<std::string, std::set<std::string> >& ras, bool append);
bool check_restricted(std::string& rs_attr,
const std::map<std::string, std::set<std::string> >& ras);

4
include/UserTemplate.h
View File

@ -32,9 +32,9 @@ public:
// -------------------------------------------------------------------------
// Restricted attributes interface implementation
// -------------------------------------------------------------------------
bool check_restricted(std::string& rs_attr, const Template* base) override
bool check_restricted(std::string& rs_attr, const Template* base, bool append) override
{
return Template::check_restricted(rs_attr, base, restricted);
return Template::check_restricted(rs_attr, base, restricted, append);
}
bool check_restricted(std::string& rs_attr) override

4
include/VirtualMachine.h
View File

@ -1224,9 +1224,9 @@ public:
* @param ra the restricted attribute found to be different
* @return true if a different restricted is found
*/
bool check_restricted(std::string& ra, VirtualMachineTemplate * tgt) const
bool check_restricted(std::string& ra, VirtualMachineTemplate * tgt, bool append) const
{
return tgt->check_restricted(ra, obj_template.get());
return tgt->check_restricted(ra, obj_template.get(), append);
}
// -------------------------------------------------------------------------

4
include/VirtualMachineTemplate.h
View File

@ -72,9 +72,9 @@ public:
// -------------------------------------------------------------------------
// Restricted attributes interface implementation
// -------------------------------------------------------------------------
bool check_restricted(std::string& rs_attr, const Template* base) override
bool check_restricted(std::string& rs_attr, const Template* base, bool append) override
{
return Template::check_restricted(rs_attr, base, restricted);
return Template::check_restricted(rs_attr, base, restricted, append);
}
bool check_restricted(std::string& rs_attr) override

4
include/VirtualNetworkTemplate.h
View File

@ -39,9 +39,9 @@ public:
// -------------------------------------------------------------------------
// Restricted attributes interface implementation
// -------------------------------------------------------------------------
bool check_restricted(std::string& rs_attr, const Template* base) override
bool check_restricted(std::string& rs_attr, const Template* base, bool append) override
{
return Template::check_restricted(rs_attr, base, restricted);
return Template::check_restricted(rs_attr, base, restricted, append);
}
bool check_restricted(std::string& rs_attr) override

5
src/pool/PoolObjectSQL.cc
View File

@ -278,7 +278,7 @@ int PoolObjectSQL::replace_template(
if (obj_template)
{
if ( keep_restricted &&
new_tmpl->check_restricted(ra, obj_template.get()) )
new_tmpl->check_restricted(ra, obj_template.get(), false) )
{
error = "Tried to change restricted attribute: " + ra;
@ -339,11 +339,12 @@ int PoolObjectSQL::append_template(
if ( obj_template )
{
if (keep_restricted &&
new_tmpl->check_restricted(rname, obj_template.get()))
new_tmpl->check_restricted(rname, obj_template.get(), true))
{
error ="User Template includes a restricted attribute " + rname;
return -1;
}
old_tmpl = std::make_unique<Template>(*obj_template);
obj_template->merge(new_tmpl.get());
}
else

2
src/rm/RequestManagerVMTemplate.cc
View File

@ -320,7 +320,7 @@ Request::ErrorCode VMTemplateInstantiate::merge(
if (!att.is_admin())
{
if (uattrs.check_restricted(aname, tmpl))
if (uattrs.check_restricted(aname, tmpl, true))
{
att.resp_msg ="User Template includes a restricted attribute " + aname;

2
src/rm/RequestManagerVNTemplate.cc
View File

@ -208,7 +208,7 @@ Request::ErrorCode VNTemplateInstantiate::merge(
if (!att.is_admin())
{
if (uattrs.check_restricted(aname, tmpl))
if (uattrs.check_restricted(aname, tmpl, true))
{
att.resp_msg ="User Template includes a restricted attribute " + aname;

2
src/rm/RequestManagerVirtualMachine.cc
View File

@ -3646,7 +3646,7 @@ void VirtualMachineUpdateConf::request_execute(
{
string aname;
if ( vm->check_restricted(aname, uc_tmpl.get()) )
if ( vm->check_restricted(aname, uc_tmpl.get(), update_type == 1) )
{
att.resp_msg = "Template includes a restricted attribute " + aname;
failure_response(AUTHORIZATION, att);

9
src/template/Template.cc
View File

@ -787,17 +787,18 @@ static bool restricted_values(const string& vname, const set<string>& vsubs,
}
bool Template::check_restricted(string& ra, const Template* base,
const std::map<std::string, std::set<std::string> >& ras)
const std::map<std::string, std::set<std::string> >& ras, bool append)
{
for ( auto rit = ras.begin(); rit != ras.end(); ++rit )
{
if (!(rit->second).empty())
{
vector<string> rvalues, rvalues_base;
bool has_restricted;
has_restricted = restricted_values(rit->first, rit->second, this, rvalues);
restricted_values(rit->first, rit->second, base, rvalues_base);
bool new_restricted = restricted_values(rit->first, rit->second, this, rvalues);
bool base_restricted = restricted_values(rit->first, rit->second, base, rvalues_base);
bool has_restricted = new_restricted || (!append && base_restricted);
if ( rvalues != rvalues_base && has_restricted)
{

4
src/vm/VirtualMachine.cc
View File

@ -2807,7 +2807,7 @@ int VirtualMachine::replace_template(
if (user_obj_template)
{
if (keep_restricted &&
new_tmpl->check_restricted(ra, user_obj_template.get()))
new_tmpl->check_restricted(ra, user_obj_template.get(), false))
{
error = "Tried to change restricted attribute: " + ra;
@ -2860,7 +2860,7 @@ int VirtualMachine::append_template(
auto old_user_tmpl = make_unique<VirtualMachineTemplate>(*user_obj_template);
if (keep_restricted &&
new_tmpl->check_restricted(rname, user_obj_template.get()))
new_tmpl->check_restricted(rname, user_obj_template.get(), true))
{
error ="User Template includes a restricted attribute " + rname;

4
src/vnm/VirtualNetwork.cc
View File

@ -1469,7 +1469,7 @@ int VirtualNetwork::replace_template(const std::string& tmpl_str,
}
if ( keep_restricted &&
new_tmpl->check_restricted(ra, obj_template.get()) )
new_tmpl->check_restricted(ra, obj_template.get(), false) )
{
error = "Tried to change restricted attribute: " + ra;
@ -1521,7 +1521,7 @@ int VirtualNetwork::append_template(
set_updated_attributes(new_tmpl.get(), false);
if (keep_restricted &&
new_tmpl->check_restricted(rname, obj_template.get()))
new_tmpl->check_restricted(rname, obj_template.get(), true))
{
error ="User Template includes a restricted attribute " + rname;
return -1;