Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict adding or editing custom attributes via API by section #13360

Merged
merged 1 commit into from Jan 9, 2017
Merged

Restrict adding or editing custom attributes via API by section #13360

merged 1 commit into from Jan 9, 2017

Conversation

dkorn
Copy link
Contributor

@dkorn dkorn commented Jan 5, 2017

The only supported sections are: “metadata” and “cluster_settings”

@dkorn
Copy link
Contributor Author

dkorn commented Jan 5, 2017

@miq-bot add_label api

@miq-bot miq-bot added the api label Jan 5, 2017
@dkorn
Copy link
Contributor Author

dkorn commented Jan 5, 2017

@enoodle @simon3z @abellotti please review

enoodle
enoodle approved these changes Jan 5, 2017
View reviewed changes
Copy link

@enoodle enoodle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

spec/requests/api/providers_spec.rb
@@ -179,15 +179,24 @@
expect_bad_request("Must specify a name")
end

it "add custom attribute to a provider with forbidden section" do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: change name to "blocks adding ..." or "prevents .."

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, thanks!

abellotti
abellotti reviewed Jan 5, 2017
View reviewed changes
app/controllers/api/providers_controller.rb
@@ -91,7 +91,12 @@ def format_provider_custom_attributes(attribute)
attribute["value"] = attribute.delete("field_type").safe_constantize.parse(attribute["value"])
end
attribute["section"] ||= "metadata" unless @req.action == "edit"
if attribute["section"].present? && !(CustomAttribute::ALLOWED_API_SECTIONS.include? attribute["section"])
raise ForbiddenError, "Unauthorized attribute section specified: #{attribute["section"]}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should be a BadRequestError, ForbiddenError is meant for HTTP 403 (i.e. resource RBAC) maybe change to:

raise "Invalid attribute section specified: #{attribute["section"]}"

and remove the rescue ForbiddenErrror below, it will be picked up by the rescue and raise in lines 100-101.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abellotti Actually raising ForbiddenError was my intention, since we don't want to allow adding or editing cas with unauthorized sections.
@simon3z what is your opinion?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we'd still not be allowing it with the BadRequestError (400), 403's definition is at higher level than a custom attribute section of a resource.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abellotti Done, thanks.

@dkorn
Restrict adding or editing custom attributes via API by section
0631d36 
The only supported sections are: “metadata” and “cluster_settings”
@miq-bot
Copy link
Member

miq-bot commented Jan 8, 2017

Checked commit dkorn@0631d36 with ruby 2.2.5, rubocop 0.37.2, and haml-lint 0.16.1
3 files checked, 0 offenses detected
Everything looks good. 👍

@enoodle enoodle mentioned this pull request Jan 8, 2017
Merged
@abellotti
Copy link
Member

LGTM!!

@abellotti abellotti merged commit aa69a4f into ManageIQ:master Jan 9, 2017
@enoodle
Copy link

enoodle commented Jan 11, 2017

@miq-bot add_label euwe/yes

@enoodle
Copy link

enoodle commented Jan 18, 2017

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1411356

@enoodle
Copy link

enoodle commented Jan 18, 2017

@simaishi PTAL

simaishi pushed a commit that referenced this pull request Jan 18, 2017
@abellotti @simaishi
Merge pull request #13360 from dkorn/restrict_ca_sections
8522187 
Restrict adding or editing custom attributes via API by section
(cherry picked from commit aa69a4f)

https://bugzilla.redhat.com/show_bug.cgi?id=1414451
@simaishi
Copy link
Contributor

Euwe backport details:

$ git log -1
commit 8522187d98c6e10f7e15d8efb18794491601c917
Author: Alberto Bellotti <abellotti@users.noreply.github.com>
Date:   Mon Jan 9 09:22:44 2017 -0500

    Merge pull request #13360 from dkorn/restrict_ca_sections
    
    Restrict adding or editing custom attributes via API by section
    (cherry picked from commit aa69a4fe5a74409e15e722674ad0060501bce0da)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1414451

@chessbyte chessbyte added this to the Sprint 52 Ending Jan 16, 2017 milestone Jan 31, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@abellotti abellotti abellotti left review comments

@enoodle enoodle enoodle approved these changes

Assignees

@abellotti abellotti

Labels
api enhancement euwe/backported
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@dkorn @miq-bot @abellotti @enoodle @simaishi @chessbyte