Skip to content

Commit d9696b2

Browse files
author
Prachi Damle
committed
After merge, fix isRootAdmin() calls to use accountId instead of type
1 parent 99bdc8d commit d9696b2

9 files changed

Lines changed: 37 additions & 30 deletions

File tree

‎api/src/com/cloud/user/AccountService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ UserAccount createUserAccount(String userName, String password, String firstName
8888

8989
User getUserIncludingRemoved(long userId);
9090

91-
boolean isRootAdmin(long accountId);
91+
boolean isRootAdmin(Long accountId);
9292

93-
boolean isDomainAdmin(long accountId);
93+
boolean isDomainAdmin(Long accountId);
9494

9595
boolean isNormalUser(long accountId);
9696

‎server/src/com/cloud/api/query/QueryManagerImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,7 @@ private Pair<List<EventJoinVO>, Integer> searchForEventsInternal(ListEventsCmd c
520520
_accountMgr.buildACLViewSearchCriteria(sc, aclSc, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);
521521

522522
// For end users display only enabled events
523-
if(!_accountMgr.isRootAdmin(caller.getType())){
523+
if (!_accountMgr.isRootAdmin(caller.getId())) {
524524
sc.setParameters("displayEvent", true);
525525
}
526526

‎server/src/com/cloud/deploy/DeploymentPlanningManagerImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,7 @@ private void checkForNonDedicatedResources(VirtualMachineProfile vmProfile, Data
508508

509509
// check if zone is dedicated. if yes check if vm owner has acess to it.
510510
DedicatedResourceVO dedicatedZone = _dedicatedDao.findByZoneId(dc.getId());
511-
if (dedicatedZone != null && !_accountMgr.isRootAdmin(vmProfile.getOwner().getType())) {
511+
if (dedicatedZone != null && !_accountMgr.isRootAdmin(vmProfile.getOwner().getId())) {
512512
long accountDomainId = vmProfile.getOwner().getDomainId();
513513
long accountId = vmProfile.getOwner().getAccountId();
514514

‎server/src/com/cloud/network/NetworkServiceImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1805,7 +1805,7 @@ public boolean deleteNetwork(long networkId, boolean forced) {
18051805
// Perform permission check
18061806
_accountMgr.checkAccess(caller, null, true, network);
18071807

1808-
if (forced && !_accountMgr.isRootAdmin(caller.getType())) {
1808+
if (forced && !_accountMgr.isRootAdmin(caller.getId())) {
18091809
throw new InvalidParameterValueException("Delete network with 'forced' option can only be called by root admins");
18101810
}
18111811

‎server/src/com/cloud/storage/VolumeApiServiceImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -386,7 +386,7 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
386386
if (displayVolume == null) {
387387
displayVolume = true;
388388
} else {
389-
if (!_accountMgr.isRootAdmin(caller.getType())) {
389+
if (!_accountMgr.isRootAdmin(caller.getId())) {
390390
throw new PermissionDeniedException("Cannot update parameter displayvolume, only admin permitted ");
391391
}
392392
}

‎server/src/com/cloud/user/AccountManagerImpl.java‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -366,37 +366,40 @@ public boolean isAdmin(short accountType) {
366366
}
367367

368368
@Override
369-
public boolean isRootAdmin(long accountId) {
370-
AccountVO acct = _accountDao.findById(accountId);
371-
for (SecurityChecker checker : _securityCheckers) {
372-
try {
373-
if (checker.checkAccess(acct, null, null, "SystemCapability")) {
374-
if (s_logger.isDebugEnabled()) {
375-
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
369+
public boolean isRootAdmin(Long accountId) {
370+
if (accountId != null) {
371+
AccountVO acct = _accountDao.findById(accountId);
372+
for (SecurityChecker checker : _securityCheckers) {
373+
try {
374+
if (checker.checkAccess(acct, null, null, "SystemCapability")) {
375+
if (s_logger.isDebugEnabled()) {
376+
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
377+
}
378+
return true;
376379
}
377-
return true;
380+
} catch (PermissionDeniedException ex) {
381+
return false;
378382
}
379-
} catch (PermissionDeniedException ex) {
380-
return false;
381383
}
382384
}
383-
384385
return false;
385386
}
386387

387388
@Override
388-
public boolean isDomainAdmin(long accountId) {
389-
AccountVO acct = _accountDao.findById(accountId);
390-
for (SecurityChecker checker : _securityCheckers) {
391-
try {
392-
if (checker.checkAccess(acct, null, null, "DomainCapability")) {
393-
if (s_logger.isDebugEnabled()) {
394-
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
389+
public boolean isDomainAdmin(Long accountId) {
390+
if (accountId != null) {
391+
AccountVO acct = _accountDao.findById(accountId);
392+
for (SecurityChecker checker : _securityCheckers) {
393+
try {
394+
if (checker.checkAccess(acct, null, null, "DomainCapability")) {
395+
if (s_logger.isDebugEnabled()) {
396+
s_logger.debug("Root Access granted to " + acct + " by " + checker.getName());
397+
}
398+
return true;
395399
}
396-
return true;
400+
} catch (PermissionDeniedException ex) {
401+
return false;
397402
}
398-
} catch (PermissionDeniedException ex) {
399-
return false;
400403
}
401404
}
402405
return false;

‎server/src/com/cloud/uuididentity/UUIDManagerImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public <T> void checkUuid(String uuid, Class<T> entityType) {
5050
Account caller = CallContext.current().getCallingAccount();
5151

5252
// Only admin and system allowed to do this
53-
if (!(caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getType()))) {
53+
if (!(caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getId()))) {
5454
throw new PermissionDeniedException("Please check your permissions, you are not allowed to create/update custom id");
5555
}
5656

‎server/test/com/cloud/user/MockAccountManagerImpl.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ public User getUserIncludingRemoved(long userId) {
162162
}
163163

164164
@Override
165-
public boolean isRootAdmin(long accountId) {
165+
public boolean isRootAdmin(Long accountId) {
166166
// TODO Auto-generated method stub
167167
return false;
168168
}
@@ -298,7 +298,7 @@ public Account createAccount(String accountName, short accountType, Long domainI
298298
}
299299

300300
@Override
301-
public boolean isDomainAdmin(long accountId) {
301+
public boolean isDomainAdmin(Long accountId) {
302302
// TODO Auto-generated method stub
303303
return false;
304304
}
@@ -356,4 +356,5 @@ public Long finalyzeAccountId(String accountName, Long domainId, Long projectId,
356356
return null;
357357
}
358358

359+
359360
}

‎services/iam/plugin/src/org/apache/cloudstack/iam/RoleBasedEntityAccessChecker.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ public boolean checkAccess(Account caller, ControlledEntity entity, AccessType a
6363
public boolean checkAccess(Account caller, ControlledEntity entity, AccessType accessType, String action)
6464
throws PermissionDeniedException {
6565

66+
if (caller == null) {
67+
throw new InvalidParameterValueException("Caller cannot be passed as NULL to IAM!");
68+
}
6669
if (entity == null && action != null) {
6770
// check if caller can do this action
6871
List<IAMPolicy> policies = _iamSrv.listIAMPolicies(caller.getAccountId());

0 commit comments

Comments
 (0)