7ba9935a6e
There is an initial policy check in the transfers accept API[1] which validates correctly if the user is authorized to perform the operation or not. However, we've a duplicate check in the volume API layer which passes a target object (volume) while authorizing which is wrong for this API. While authorizing, we enforce check on the project id of the target object i.e. volume in this case which, before the transfer operation is completed, contains the project id of source project hence making the validation wrong. In the case of transfers API, any project is able to accept the transfer given they've the auth key required to secure the transfer accept So this patch removes the duplicate policy check. [1] https://opendev.org/openstack/cinder/src/branch/master/cinder/transfer/api.py#L225 Closes-Bug: #1950474 Change-Id: I3930bff90df835d9d8bbf7e6e91458db7e5654be
OpenStack Cinder
OpenStack Cinder is a storage service for an open cloud computing service.
You can learn more about Cinder at:
Getting Started
If you'd like to run from the master branch, you can clone the git repo:
git clone https://opendev.org/openstack/cinder
If you'd like to contribute, please see the information in CONTRIBUTING.rst
You can raise bugs on Launchpad