You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficcontrol.apache.org by mi...@apache.org on 2017/08/18 17:24:42 UTC
[1/2] incubator-trafficcontrol git commit: ssl_keys - tenancy checks
Repository: incubator-trafficcontrol
Updated Branches:
refs/heads/master e1bf81260 -> ac6cf5ba4
ssl_keys - tenancy checks
Project: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/commit/01452c99
Tree: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/tree/01452c99
Diff: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/diff/01452c99
Branch: refs/heads/master
Commit: 01452c99a0fc4d459742a67bad3bab9f20fcf4e6
Parents: e1bf812
Author: nir-sopher <ni...@qwilt.com>
Authored: Sun Aug 13 19:01:38 2017 +0300
Committer: Jeremy Mitchell <mi...@gmail.com>
Committed: Fri Aug 18 11:24:10 2017 -0600
----------------------------------------------------------------------
.../app/lib/API/DeliveryService/SslKeys.pm | 39 +++++++++++++++++++-
.../app/t/api/1.1/deliveryservice/ssl_keys.t | 10 +++++
2 files changed, 48 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/blob/01452c99/traffic_ops/app/lib/API/DeliveryService/SslKeys.pm
----------------------------------------------------------------------
diff --git a/traffic_ops/app/lib/API/DeliveryService/SslKeys.pm b/traffic_ops/app/lib/API/DeliveryService/SslKeys.pm
index 069d146..8550a41 100644
--- a/traffic_ops/app/lib/API/DeliveryService/SslKeys.pm
+++ b/traffic_ops/app/lib/API/DeliveryService/SslKeys.pm
@@ -18,6 +18,7 @@ package API::DeliveryService::SslKeys;
# JvD Note: you always want to put Utils as the first use. Sh*t don't work if it's after the Mojo lines.
use UI::Utils;
+use Utils::Tenant;
use Mojo::Base 'Mojolicious::Controller';
use MojoPlugins::Response;
use JSON;
@@ -40,6 +41,17 @@ sub add {
if ( !&is_admin($self) ) {
return $self->alert( { Error => " - You must be an ADMIN to perform this operation!" } );
}
+
+ my $ds = $self->db->resultset('Deliveryservice')->search( { xml_id => $deliveryservice })->single();
+ if (!$ds) {
+ return $self->not_found("Could not found delivery service with xml_id=$deliveryservice" );
+ }
+ my $tenant_utils = Utils::Tenant->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $ds->tenant_id)) {
+ return $self->forbidden("Forbidden. Delivery-service tenant is not available to the user.");
+ }
+
my $record = {
key => $key,
version => $version,
@@ -83,6 +95,17 @@ sub generate {
if ( !&is_admin($self) ) {
return $self->alert( { Error => " - You must be an ADMIN to perform this operation!" } );
}
+ if (defined($deliveryservice)) {
+ my $ds = $self->db->resultset('Deliveryservice')->search( { xml_id => $deliveryservice })->single();
+ if (!$ds) {
+ return $self->not_found("Could not found delivery service with xml_id=$deliveryservice" );
+ }
+ my $tenant_utils = Utils::Tenant->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $ds->tenant_id)) {
+ return $self->forbidden("Forbidden. Delivery-service tenant is not available to the user.");
+ }
+ }
#generate the cert:
my $record = {
@@ -124,6 +147,11 @@ sub view_by_xml_id {
if (!$ds) {
return $self->alert( { Error => " - Could not found delivery service with xml_id=$xml_id!" } );
}
+ my $tenant_utils = Utils::Tenant->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $ds->tenant_id)) {
+ return $self->forbidden("Forbidden. Delivery-service tenant is not available to the user.");
+ }
my $ds_id = $ds->id;
my $key = "ds_$ds_id-$version";
my $response_container = $self->riak_get( "ssl", $key );
@@ -171,7 +199,11 @@ sub view_by_hostname {
if (!$ds) {
return $self->alert( { Error => " - A delivery service does not exist for a host with hostanme of $key" } );
}
-
+ my $tenant_utils = Utils::Tenant->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $ds->tenant_id)) {
+ return $self->forbidden("Forbidden. Delivery-service tenant is not available to the user.");
+ }
my $ds_id = $ds->id;
if ( !$version ) {
@@ -206,6 +238,11 @@ sub delete {
if (!$ds) {
return $self->alert( { Error => " - Could not found delivery service with xml_id=$xml_id!" } );
}
+ my $tenant_utils = Utils::Tenant->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $ds->tenant_id)) {
+ return $self->forbidden("Forbidden. Delivery-service tenant is not available to the user.");
+ }
my $ds_id = $ds->id;
my $key = "ds_$ds_id";
if ($version) {
http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/blob/01452c99/traffic_ops/app/t/api/1.1/deliveryservice/ssl_keys.t
----------------------------------------------------------------------
diff --git a/traffic_ops/app/t/api/1.1/deliveryservice/ssl_keys.t b/traffic_ops/app/t/api/1.1/deliveryservice/ssl_keys.t
index 3a3a42e..11b71ca 100644
--- a/traffic_ops/app/t/api/1.1/deliveryservice/ssl_keys.t
+++ b/traffic_ops/app/t/api/1.1/deliveryservice/ssl_keys.t
@@ -153,6 +153,16 @@ ok $t->get_ok("/api/1.1/deliveryservices/hostname/$gen_hostname/sslkeys.json")->
->json_is( "/response/version" => $version )->json_is( "/response/country" => $country )->json_is( "/response/hostname" => $hostname )->status_is(200)
->or( sub { diag $t->tx->res->content->asset->{content}; } );
+
+#tenancy checks
+#get_object
+ok $t->get_ok("/api/1.1/deliveryservices/xmlId/test-ds1-root/sslkeys.json")->status_is(403)
+ ->json_has("Forbidden. Delivery-service tenant is not available to the user.!")->or( sub { diag $t->tx->res->content->asset->{content}; } );
+
+#delete
+ok $t->get_ok("/api/1.1/deliveryservices/xmlId/test-ds1-root/sslkeys/delete.json")->status_is(403)
+ ->json_has("Forbidden. Delivery-service tenant is not available to the user.!")->or( sub { diag $t->tx->res->content->asset->{content}; } );
+
# #delete ssl key
# #delete version
ok $t->get_ok("/api/1.1/deliveryservices/xmlId/$key/sslkeys/delete.json?version=$version")
[2/2] incubator-trafficcontrol git commit: This closes #832
Posted by mi...@apache.org.
This closes #832
Project: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/commit/ac6cf5ba
Tree: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/tree/ac6cf5ba
Diff: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/diff/ac6cf5ba
Branch: refs/heads/master
Commit: ac6cf5ba4dc191bb71532d030b3d3da0b50145bf
Parents: 01452c9
Author: Jeremy Mitchell <mi...@gmail.com>
Authored: Fri Aug 18 11:24:26 2017 -0600
Committer: Jeremy Mitchell <mi...@gmail.com>
Committed: Fri Aug 18 11:24:26 2017 -0600
----------------------------------------------------------------------
----------------------------------------------------------------------