[jira] [Closed] (CLOUDSTACK-1054) ListDomains does not list all domains when the name is specified

["Wido den Hollander (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CLOUDSTACK-1054?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Wido den Hollander closed CLOUDSTACK-1054.
------------------------------------------

    
> ListDomains does not list all domains when the name is specified
> ----------------------------------------------------------------
>
>                 Key: CLOUDSTACK-1054
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-1054
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: API
>    Affects Versions: 4.0.0, 4.0.1, 4.1.0
>            Reporter: Wido den Hollander
>            Assignee: Wido den Hollander
>            Priority: Minor
>             Fix For: Future
>
>
> The documentation for listDomains says that you can list all domains by specifying the 'name'.
> id: List domain by domain ID.
> name: List domain by domain name.
> When doing this however you don't get the expected result.
> I turned on MySQL debugging and it showed me this query:
> SELECT domain.id, domain.parent, domain.name, domain.owner, domain.path, domain.level, domain.removed, domain.child_count, domain.next_child_seq, domain.state, domain.network_domain, domain.uuid FROM domain WHERE domain.id = 1  AND domain.name LIKE _binary'%pcextreme%'  AND domain.state = 'Active'  AND domain.removed IS NULL  ORDER BY domain.id ASC  LIMIT 0, 500
> What I noticed is 'domain.id = 1'.
> I haven't specified an ID and still it is set?
> Going into the code (DomainManagerImpl) I found:
>         Long domainId = cmd.getId();
>         boolean listAll = cmd.listAll();
>         boolean isRecursive = false;
>         if (domainId != null) {
>             Domain domain = getDomain(domainId);
>             if (domain == null) {
>                 throw new InvalidParameterValueException("Domain id=" + domainId + " doesn't exist");
>             }
>             _accountMgr.checkAccess(caller, domain);
>         } else {
>             domainId = caller.getDomainId();
>             if (listAll) {
>                 isRecursive = true;
>             }
>         }
> So if domainId is not specified it is automatically set to the ID of the domain I'm in? Since I'm admin my ID is set to 1.
> This is odd behaviour since I want the domain specified by the name, not by my ID.
> I understand that this is a security flaw if every user can query for every domain, but it is kind of weird.
> The description for the 'name' argument isn't clear either.
> The code does: name LIKE '%<name>%' so it is actually a wildcard search which the documentation does not say.
> I'm thinking about checking if the user is an admin and if that is the case not setting the domainId to the domain where the user is in.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira