Skip to content

Commit 5aefd77

Browse files
isaacchianggavinlxh
isaacchiang
authored and
gavinlxh
committed
Fix for CloudStack-648
Signed-off-by: Gavin Lee <gavin.lxh@gmail.com>
1 parent 5b751b2 commit 5aefd77

6 files changed

Lines changed: 50 additions & 17 deletions

File tree

‎api/src/com/cloud/api/response/UserResponse.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ public class UserResponse extends BaseResponse {
6969
@SerializedName("accountid") @Param(description="the account ID of the user")
7070
private IdentityProxy accountId = new IdentityProxy("account");
7171

72+
@SerializedName("iscallerchilddomain") @Param(description="the boolean value representing if the updating target is in caller's child domain")
73+
private boolean isCallerChildDomain;
7274

7375
public Long getId() {
7476
return id.getValue();
@@ -188,4 +190,12 @@ public Long getAccountId() {
188190
public void setAccountId(Long accountId) {
189191
this.accountId.setValue(accountId);
190192
}
193+
194+
public boolean getIsCallerSubdomain() {
195+
return this.isCallerChildDomain;
196+
}
197+
198+
public void setIsCallerChildDomain(boolean isCallerChildDomain) {
199+
this.isCallerChildDomain = isCallerChildDomain;
200+
}
191201
}

‎client/tomcatconf/commands.properties.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ markDefaultZoneForAccount=com.cloud.api.commands.MarkDefaultZoneForAccountCmd;1
3131
#### User commands
3232
createUser=com.cloud.api.commands.CreateUserCmd;3
3333
deleteUser=com.cloud.api.commands.DeleteUserCmd;3
34-
updateUser=com.cloud.api.commands.UpdateUserCmd;3
34+
updateUser=com.cloud.api.commands.UpdateUserCmd;15
3535
listUsers=com.cloud.api.commands.ListUsersCmd;7
3636
####lockUser=com.cloud.api.commands.LockUserCmd;7
3737
disableUser=com.cloud.api.commands.DisableUserCmd;7

‎server/src/com/cloud/api/ApiDBUtils.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,10 @@ public static DomainVO findDomainById(Long domainId) {
469469
public static DomainVO findDomainByIdIncludingRemoved(Long domainId) {
470470
return _domainDao.findByIdIncludingRemoved(domainId);
471471
}
472+
473+
public static boolean isChildDomain(long parentId, long childId) {
474+
return _domainDao.isChildDomain(parentId, childId);
475+
}
472476

473477
public static DomainRouterVO findDomainRouterById(Long routerId) {
474478
return _domainRouterDao.findByIdIncludingRemoved(routerId);

‎server/src/com/cloud/api/ApiResponseHelper.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ public AccountResponse createAccountResponse(Account account) {
423423

424424
@Override
425425
public UserResponse createUserResponse(UserAccount user) {
426+
Account account = UserContext.current().getCaller();
426427
UserResponse userResponse = new UserResponse();
427428
userResponse.setAccountName(user.getAccountName());
428429
userResponse.setAccountType(user.getType());
@@ -439,8 +440,8 @@ public UserResponse createUserResponse(UserAccount user) {
439440
userResponse.setApiKey(user.getApiKey());
440441
userResponse.setSecretKey(user.getSecretKey());
441442
userResponse.setAccountId((user.getAccountId()));
443+
userResponse.setIsCallerChildDomain(ApiDBUtils.isChildDomain(account.getDomainId(), user.getDomainId()));
442444
userResponse.setObjectName("user");
443-
444445
return userResponse;
445446
}
446447

‎ui/scripts/accounts.js‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1248,22 +1248,20 @@
12481248
if (jsonObj.state == 'Destroyed') return [];
12491249

12501250
if(isAdmin()) {
1251-
allowedActions.push("edit"); //updating networkdomain is allowed on any account, including system-generated default admin account
1252-
if(!(jsonObj.domain == "ROOT" && jsonObj.name == "admin" && jsonObj.accounttype == 1)) { //if not system-generated default admin account
1253-
if(jsonObj.state == "enabled") {
1254-
allowedActions.push("disable");
1255-
allowedActions.push("lock");
1256-
}
1257-
else if(jsonObj.state == "disabled" || jsonObj.state == "locked") {
1258-
allowedActions.push("enable");
1251+
allowedActions.push("edit"); //updating networkdomain is allowed on any account, including system-generated default admin account
1252+
if(!(jsonObj.domain == "ROOT" && jsonObj.name == "admin" && jsonObj.accounttype == 1)) { //if not system-generated default admin account
1253+
if(jsonObj.state == "enabled") {
1254+
allowedActions.push("disable");
1255+
allowedActions.push("lock");
1256+
} else if(jsonObj.state == "disabled" || jsonObj.state == "locked") {
1257+
allowedActions.push("enable");
1258+
}
1259+
allowedActions.push("remove");
12591260
}
1260-
allowedActions.push("remove");
1261-
}
1262-
allowedActions.push("updateResourceCount");
1263-
}
1264-
else if(isDomainAdmin()) {
1265-
allowedActions.push("updateResourceCount");
1266-
}
1261+
allowedActions.push("updateResourceCount");
1262+
} else if(isDomainAdmin()) {
1263+
allowedActions.push("updateResourceCount");
1264+
}
12671265
return allowedActions;
12681266
}
12691267

@@ -1281,6 +1279,10 @@
12811279
allowedActions.push("enable");
12821280
allowedActions.push("remove");
12831281
}
1282+
} else {
1283+
if(isSelfOrChildDomainUser(jsonObj.username, jsonObj.accounttype, jsonObj.domainid, jsonObj.iscallerchilddomain)) {
1284+
allowedActions.push("changePassword");
1285+
}
12841286
}
12851287
return allowedActions;
12861288
}

‎ui/scripts/sharedFunctions.js‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,22 @@ function isUser() {
158158
return (g_role == 0);
159159
}
160160

161+
function isSelfOrChildDomainUser(username, useraccounttype, userdomainid, iscallerchilddomain) {
162+
if(username == g_username) { //is self
163+
return true;
164+
} else if(isDomainAdmin()
165+
&& iscallerchilddomain
166+
&& (useraccounttype == 0)) { //domain admin to user
167+
return true;
168+
} else if(isDomainAdmin()
169+
&& iscallerchilddomain
170+
&& (userdomainid != g_domainid) ) { //domain admin to subdomain admin and user
171+
return true;
172+
} else {
173+
return false;
174+
}
175+
}
176+
161177
// FUNCTION: Handles AJAX error callbacks. You can pass in an optional function to
162178
// handle errors that are not already handled by this method.
163179
function handleError(XMLHttpResponse, handleErrorCallback) {

0 commit comments

Comments
 (0)