cinder/fix-transfer-accept-policy-7594806372b14284.yaml at a97fd2369395a32236e6064d82eddf3cc3aed6e8 - cinder - OpenDev: Free Software Needs Free Tools

openstack/cinder

Rajat Dhasmana 7ba9935a6e Volume transfers: Remove duplicate policy check

There is an initial policy check in the transfers accept API[1]
which validates correctly if the user is authorized to perform
the operation or not. However, we've a duplicate check in the volume
API layer which passes a target object (volume) while authorizing
which is wrong for this API. While authorizing, we enforce check on
the project id of the target object i.e. volume in this case which,
before the transfer operation is completed, contains the project id
of source project hence making the validation wrong.
In the case of transfers API, any project is able to accept the transfer
given they've the auth key required to secure the transfer accept
So this patch removes the duplicate policy check.

[1] https://opendev.org/openstack/cinder/src/branch/master/cinder/transfer/api.py#L225

Closes-Bug: #1950474
Change-Id: I3930bff90df835d9d8bbf7e6e91458db7e5654be

2022-01-11 08:32:21 -05:00

8 lines

292 B

YAML

Raw Blame History

 ---
 fixes:
   - |
     `Bug #1950474 <https://bugs.launchpad.net/cinder/+bug/1950474>`_: Fixed
     policy authorization for transfer accept API. Previously, setting
     ``enforce_new_defaults=True`` in oslo_policy section would break the
     transfer accept API which is fixed in this release.