diff --git a/manila/api/v2/share_networks.py b/manila/api/v2/share_networks.py index be97ccd8bc..d3deb31412 100644 --- a/manila/api/v2/share_networks.py +++ b/manila/api/v2/share_networks.py @@ -33,6 +33,7 @@ from manila.i18n import _ from manila import policy from manila import quota from manila.share import rpcapi as share_rpcapi +from manila import utils RESOURCE_NAME = 'share_network' RESOURCES_NAME = 'share_networks' @@ -119,7 +120,7 @@ class ShareNetworkController(wsgi.Controller): elif context.is_admin and 'project_id' in search_opts: networks = db_api.share_network_get_all_by_project( context, search_opts['project_id']) - elif context.is_admin and 'all_tenants' in search_opts: + elif context.is_admin and utils.is_all_tenants(search_opts): networks = db_api.share_network_get_all(context) else: networks = db_api.share_network_get_all_by_project( diff --git a/manila/tests/api/v2/test_share_networks.py b/manila/tests/api/v2/test_share_networks.py index a08546a408..5651bd91f6 100644 --- a/manila/tests/api/v2/test_share_networks.py +++ b/manila/tests/api/v2/test_share_networks.py @@ -408,6 +408,33 @@ class ShareNetworkAPITest(test.TestCase): result[share_networks.RESOURCES_NAME][0], fake_share_network_shortened) + @mock.patch.object(db_api, 'share_network_get_all', mock.Mock()) + def test_index_all_tenants_with_invaild_value(self): + req = fakes.HTTPRequest.blank( + '/share_networks?all_tenants=wonk', + use_admin_context=True) + + self.assertRaises(exception.InvalidInput, self.controller.index, req) + + @mock.patch.object(db_api, 'share_network_get_all_by_project', mock.Mock()) + @mock.patch.object(db_api, 'share_network_get_all', mock.Mock()) + def test_index_all_tenants_with_value_zero(self): + db_api.share_network_get_all_by_project.return_value = [ + fake_share_network] + req = fakes.HTTPRequest.blank( + '/share_networks?all_tenants=0', + use_admin_context=True) + + result = self.controller.index(req) + + self.assertEqual(1, len(result[share_networks.RESOURCES_NAME])) + self._check_share_network_view_shortened( + result[share_networks.RESOURCES_NAME][0], + fake_share_network_shortened) + db_api.share_network_get_all_by_project.assert_called_once_with( + req.environ['manila.context'], self.context.project_id) + db_api.share_network_get_all.assert_not_called() + @mock.patch.object(db_api, 'share_network_get_all_by_project', mock.Mock()) def test_index_filter_by_project_id_non_admin_context(self): req = fakes.HTTPRequest.blank( diff --git a/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml b/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml new file mode 100644 index 0000000000..455df0b79a --- /dev/null +++ b/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml @@ -0,0 +1,8 @@ +--- +fixes: + - | + The ``all_tenants`` query parameter in the share networks API (GET + /v2/{project_id}/share-networks) has been fixed to accept 'f', + 'false', 'off', 'n', 'no', or '0'. Setting the flag to any of these values + will retrieve security services only from the requester's project + namespace.