-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add directory paths to KV capabilities checks #24404
Conversation
Build Results: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a couple of questions surrounding fullSecretPath
.
@@ -95,9 +95,14 @@ export default class KvSecretMetadataModel extends Model { | |||
}; | |||
} | |||
|
|||
get permissionsPath() { | |||
return this.fullSecretPath || this.path; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Curious why fullSecretPath
wouldn't always be the value to use if it represents the full path to the secret.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because it's generated by the serializer (not easy to see from the diff). And the payload does not always return data.keys. See here.
An example of when the serializer wouldn't return this.fullSecretPath is when we're looking at a secret's details.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for fixing this! 🎉
* add getter to metadata model * add changelog and data model fix * add test coverage * add nested create coverage * Update 24404.txt * remove from data model * return to how it was
Fixes Issue #24130
Follow the instructions from the original issue to duplicate. The bug occurred because we were passing in
path
to the capabilities check butpath
does not include the full path name.Ex: for secret
beep/bop/boop
We would always pass in
boop
even if we were searching for the list return ofbeep/bop/
Now we pass in
beep/
orbeep/bop/
orbeep/bop/bop
depending on the path in the URL for the view.Screenshots using the policy on the issue
![image](https://private-user-images.githubusercontent.com/6618863/288831895-13cc6411-588a-4e25-a055-44f1d872260a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjUyNjgzNzUsIm5iZiI6MTcyNTI2ODA3NSwicGF0aCI6Ii82NjE4ODYzLzI4ODgzMTg5NS0xM2NjNjQxMS01ODhhLTRlMjUtYTA1NS00NGYxZDg3MjI2MGEucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDkwMiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA5MDJUMDkwNzU1WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9NWRlNzZiYzA0N2IzOTQ5ZTkzZTYwNzVmMDY0NGM4MGQ1MWQ1NjFiOTgzZjg2YWNkNjdhY2EwZDhjMzhiNmI2YSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.FfFW_1ekKWaT3Fk0slsrfiykZu8aq9sSXqRPaulASY0)
Before:
After:
![image](https://private-user-images.githubusercontent.com/6618863/288832062-46b1a860-94c6-425c-91c6-c0266597a219.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjUyNjgzNzUsIm5iZiI6MTcyNTI2ODA3NSwicGF0aCI6Ii82NjE4ODYzLzI4ODgzMjA2Mi00NmIxYTg2MC05NGM2LTQyNWMtOTFjNi1jMDI2NjU5N2EyMTkucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDkwMiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA5MDJUMDkwNzU1WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9ZjgzMDlmNGQ5N2Q1MTE1NmZkYzkxY2FkOTdkYzc5YWY2ZmEzZTU5NTQ1NDg2MDk0YWYzNTU4ZjljNThjMDA2YiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.oMDeuFcN7mne9j7cb-oHSpRMVWPFgak-1hQLTxCjwKs)