apache / apache/cloudstack

Switching to project view not working when user is assigned custom Project Role

未關閉
#14,014 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
component:projects component:UI type:regression
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
6 天 19 小時
30 天內合併 PR
32

描述

### problem

If account/user is added to the project with custom role (even if role permisions are "allow *") user can login to CS successfully but switching to project view will fail and generate multiple errors: "

```
The given command 'listApis' either does not exist, is not available for user. Unable to proceed. Please contact your administrator."
The given command 'listZones' either does not exist, is not available for user. Unable to proceed. Please contact your administrator.
The given command 'listCapabilities' either does not exist, is not available for user. Unable to proceed. Please contact your administrator.
...
```

Image

On browser console indeed you can see that request:
` /client/api/?command=listApis&response=json&sessionkey=xxx&projectid=xxx`
returns:
`{"listapisresponse":{"uuidList":[],"errorcode":401,"cserrorcode":9999,"errortext":"The given command 'listApis' either does not exist, is not available for user."}}
`
If user is added to the project with Admin or Regular Type without any project role, switching to project view works correctly.

Switching to project view using custom Project Roles in 4.22.1.0 works correctly.
Also using UI ver. 4.22.1.1 and Api ver: 4.22.1.0 works correctly.

No additional logs available in:
```
cloudstack/management/apilog.log
cloudstack/management/management-server.log
```

### versions

ACS: 4.22.1.1

### The steps to reproduce the bug

1. Create new project "Test"
2. Create Project Role with "allow *" permission
3. Add non-admin user to project with that Project Role
4. Switch to Project View of "Test" project

### What to do about it?

Please track the root cause and fix the bug

貢獻指南

開啟貢獻指南

研究方向

使用授予 "allow *" 的自訂 Project Role 重現此故障,接著檢查專案檢視中對 listApis、listZones 和 listCapabilities 的請求,並將其與 Admin 或 Regular 專案成員資格進行比較。在 API/UI 版本 4.22.1.1 和 4.22.1.0 中檢查行為。完成標準是:自訂角色使用者可以在沒有授權錯誤的情況下切換至專案檢視,且列出的請求都成功。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
api, authorization
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
活躍
描述清晰度
基本清楚
新手友好度
55/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。