openstack/manila
Code Issues Proposed changes

Enforce policy checks for share export locations

Browse Source 
Closes-bug: #1654598
Change-Id: I5f358266739f1c42343d5a0c5ec8109c8fcaac4d
This commit is contained in:
Tom Barron 2020-03-01 13:12:08 +01:00 committed by Goutham Pacha Ravi
parent a43f0666c8
commit 84daeb481d
3 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
manila/api/v2/share_export_locations.py
View File

@ -20,6 +20,7 @@ from manila.api.views import export_locations as export_locations_views
from manila.db import api as db_api
from manila import exception
from manila.i18n import _
from manila import policy
class ShareExportLocationController(wsgi.Controller):
@ -32,7 +33,9 @@ class ShareExportLocationController(wsgi.Controller):
def _verify_share(self, context, share_id):
try:
db_api.share_get(context, share_id)
share = db_api.share_get(context, share_id)
if not share['is_public']:
policy.check_policy(context, 'share', 'get', share)
except exception.NotFound:
msg = _("Share '%s' not found.") % share_id
raise exc.HTTPNotFound(explanation=msg)

8
manila/api/v2/share_instance_export_locations.py
View File

@ -21,6 +21,7 @@ from manila.api.views import export_locations as export_locations_views
from manila.db import api as db_api
from manila import exception
from manila.i18n import _
from manila import policy
class ShareInstanceExportLocationController(wsgi.Controller):
@ -33,7 +34,12 @@ class ShareInstanceExportLocationController(wsgi.Controller):
def _verify_share_instance(self, context, share_instance_id):
try:
db_api.share_instance_get(context, share_instance_id)
share_instance = db_api.share_instance_get(context,
share_instance_id,
with_share_data=True)
if not share_instance['is_public']:
policy.check_policy(context, 'share_instance', 'show',
share_instance)
except exception.NotFound:
msg = _("Share instance '%s' not found.") % share_instance_id
raise exc.HTTPNotFound(explanation=msg)

6
releasenotes/notes/bug-1654598-enforce-policy-checks-for-share-export-locations-a5cea1ec123b1469.yaml Normal file
View File

@ -0,0 +1,6 @@
---
security:
- |
Closes a gap where a user can see the export locations for another user's
share if the uuid of the other share is leaked, stolen, or (improbably)
guessed.