You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by pe...@apache.org on 2025/05/28 11:23:07 UTC
(cloudstack) 02/04: Skip verification of privileges on project accounts
This is an automated email from the ASF dual-hosted git repository.
pearl11594 pushed a commit to branch 4.20
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
commit bef86aff82fa3f456c0786929f6a2ca45d9ea7e9
Author: Harikrishna Patnala <ha...@gmail.com>
AuthorDate: Wed May 28 12:59:41 2025 +0530
Skip verification of privileges on project accounts
---
.../main/java/com/cloud/user/AccountManagerImpl.java | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index a0cd5113812..ecd761bb7d9 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -1579,16 +1579,20 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
public void verifyCallerPrivilegeForUserOrAccountOperations(Account userAccount) {
logger.debug(String.format("Verifying whether the caller has the correct privileges based on the user's role type and API permissions: %s", userAccount));
- checkCallerRoleTypeAllowedForUserOrAccountOperations(userAccount, null);
- checkCallerApiPermissionsForUserOrAccountOperations(userAccount);
+ if (!Account.Type.PROJECT.equals(userAccount.getType())) {
+ checkCallerRoleTypeAllowedForUserOrAccountOperations(userAccount, null);
+ checkCallerApiPermissionsForUserOrAccountOperations(userAccount);
+ }
}
protected void verifyCallerPrivilegeForUserOrAccountOperations(User user) {
logger.debug(String.format("Verifying whether the caller has the correct privileges based on the user's role type and API permissions: %s", user));
Account userAccount = getAccount(user.getAccountId());
- checkCallerRoleTypeAllowedForUserOrAccountOperations(userAccount, user);
- checkCallerApiPermissionsForUserOrAccountOperations(userAccount);
+ if (!Account.Type.PROJECT.equals(userAccount.getType())) {
+ checkCallerRoleTypeAllowedForUserOrAccountOperations(userAccount, user);
+ checkCallerApiPermissionsForUserOrAccountOperations(userAccount);
+ }
}
protected void checkCallerRoleTypeAllowedForUserOrAccountOperations(Account userAccount, User user) {
@@ -1597,7 +1601,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
RoleType userAccountRoleType = getRoleType(userAccount);
if (RoleType.Unknown == callerRoleType || RoleType.Unknown == userAccountRoleType) {
- String errMsg = String.format("The role type of account [%s, %s] or [%s, %s] is unknown",
+ String errMsg = String.format("The role type of caller account [%s, %s] or target account [%s, %s] is unknown",
callingAccount.getName(), callingAccount.getUuid(), userAccount.getName(), userAccount.getUuid());
throw new PermissionDeniedException(errMsg);
}
@@ -2707,10 +2711,8 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
}
}
- if (!Account.Type.PROJECT.equals(accountType)) {
- AccountVO newAccount = new AccountVO(accountName, domainId, networkDomain, accountType, roleId, uuid);
- verifyCallerPrivilegeForUserOrAccountOperations(newAccount);
- }
+ AccountVO newAccount = new AccountVO(accountName, domainId, networkDomain, accountType, roleId, uuid);
+ verifyCallerPrivilegeForUserOrAccountOperations(newAccount);
// Create the account
return Transaction.execute(new TransactionCallback<>() {