Mailing-List: contact issues-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Date: Mon, 9 Dec 2013 16:28:08 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: cloudstack-issues@incubator.apache.org
Message-ID: <JIRA.12678770.1384253820738.3114.1386606488763@arcas>
In-Reply-To: <JIRA.12678770.1384253820738@arcas>
References: <JIRA.12678770.1384253820738@arcas>
Subject: [jira] [Commented] (CLOUDSTACK-5145) ListNetworkACL API should list
 ACLs owned by the user only
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/CLOUDSTACK-5145?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13843291#comment-13843291 ] 

ASF subversion and git services commented on CLOUDSTACK-5145:
-------------------------------------------------------------

Commit 33ff20e1c31b18d7618f04b672cce0b8f110d7dc in branch refs/heads/4.3 from [~kishan]
[ https://git-wip-us.apache.org/repos/asf?p=cloudstack.git;h=33ff20e ]

CLOUDSTACK-5145 : Added permission checks while listing network ACLs and acl Items. Users will be able to list items that they have access to.


> ListNetworkACL API should list ACLs owned by the user only
> ----------------------------------------------------------
>
>                 Key: CLOUDSTACK-5145
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-5145
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>            Reporter: Kishan Kavala
>            Assignee: Kishan Kavala
>            Priority: Blocker
>             Fix For: 4.2.1, 4.3.0
>
>
> ListNetworkACL API should filter ACLs by caller and list ACLs which can be accessed by the user only. 
> If API call is not called with a networkid or other filter, every ACL in the system is dumped, which is both a performance issue and a security issue. If a networkid is provided, but the network doesn't have an ACL list or any ACL items attached, the same issue occurs.
> Likewise, listNetworkACLLists gives access to see non-owned lists, which in turn gives vpc ids for non-owned resources.
> Example:
> 1. Set up a zone
> 2. Create a VPC or network as admin
> 3. Create an ACL list for the network
> 4. Create a new domain and unprivileged user
> 5. Generate API keys for user
> 6. Issue a 'listNetworkACLs' API call. You should see the ACL list items from the admin-owned list
> 7. Issue a 'listNetworkACLLists' API call referencing aclid from non-owned acl item. You should see the acl list info and which vpc it belongs to. 
> 8. Listing the vpc attached to the acl list properly stops with an 'unauthorized' response as step 7 above should.


--
This message was sent by Atlassian JIRA
(v6.1.4#6159)