TommyLike 7391070474 Add missing 'target_obj' when perform policy check ... Generally, we have to pass target object to ``authorize`` when enforce policy check, but this is ignored during our develop and review process for a long time, and the potential issue is anyone can handle the target resource as ``authorize`` will always succeed if rule is defined ``admin_or_owner`` [1]. Luckily, for most of those APIs this security concern is protected by our database access code [2] that only project scope resource is allowed. However, there is one API that do have security issue when administrator change the rule into "admin_or_owner". 1. "volume reset_status", which cinder will update the resource directly in the database, procedure to reproduce bug is described on the launchpad. This patch intends to correct most of cases which can be easily figured out in case of future code changes. [1]: 73e6e3c147/cinder/context.py (L206) [2]: 73e6e3c147/cinder/db/sqlalchemy/api.py (L3058) [3]: 73e6e3c147/cinder/api/contrib/admin_actions.py (L161) Partial-Bug: #1714858 Change-Id: I351b3ddf8dfe29da8d854d4038d64ca7be17390f		2018-03-19 19:02:00 +08:00
..
__init__.py	Move oslo.utils to oslo_utils namespace	2015-01-19 21:50:34 -06:00
api.py	Add missing 'target_obj' when perform policy check	2018-03-19 19:02:00 +08:00