[2.5, RBAC, API] maas machines list-allocated shows machines the user don't have access to
Bug #1812201 reported by
Björn Tillenius
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| MAAS |
Fix Released
|
High
|
Alberto Donato | ||
Bug Description
This is with MAAS 2.5.1-7489-
I have a user that has the User role on a resource pool and allocates a machine to him.
An admin now removes the User role, so that he no long have access to the machines.
The 'machines read' API command confirms that he can't see the machines.
However, if he uses the 'machines list-allocated' command, he can still see
the machine.
Related branches
~ack/maas:1812201-list-allocated-rbac-2.5
- Alberto Donato (community): Approve
-
Diff: 111 lines (+42/-25)4 files modifiedsrc/maasserver/api/machines.py (+6/-4)
src/maasserver/api/tests/test_machines.py (+35/-0)
src/maasserver/models/node.py (+0/-21)
src/maasserver/models/tests/test_node.py (+1/-0)
~ack/maas:1812201-list-allocated-rbac
- Björn Tillenius: Approve
- MAAS Lander: Approve
-
Diff: 111 lines (+42/-25)4 files modifiedsrc/maasserver/api/machines.py (+6/-4)
src/maasserver/api/tests/test_machines.py (+35/-0)
src/maasserver/models/node.py (+0/-21)
src/maasserver/models/tests/test_node.py (+1/-0)
| tags: | added: api rbac |
| Changed in maas: | |
| status: | New → Triaged |
| importance: | Undecided → High |
| milestone: | none → 2.5.1 |
| Changed in maas: | |
| assignee: | nobody → Alberto Donato (ack) |
| Changed in maas: | |
| status: | Triaged → In Progress |
| Changed in maas: | |
| status: | In Progress → Fix Committed |
| Changed in maas: | |
| status: | Fix Committed → Fix Released |
To post a comment you must log in.
