Skip to content

Commit 999eb1a

Browse files
author
Anurag Awasthi
committed
Allow root admins to add / remove template permissions for across domain projects/accounts
1 parent 133be3e commit 999eb1a

1 file changed

Lines changed: 43 additions & 28 deletions

File tree

‎server/src/main/java/com/cloud/template/TemplateManagerImpl.java‎

Lines changed: 43 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -32,34 +32,14 @@
3232
import javax.inject.Inject;
3333
import javax.naming.ConfigurationException;
3434

35-
import com.cloud.deploy.DeployDestination;
36-
import com.cloud.storage.ImageStoreUploadMonitorImpl;
37-
import com.cloud.utils.StringUtils;
38-
import com.cloud.utils.EncryptionUtil;
39-
import com.cloud.utils.DateUtil;
40-
import com.cloud.utils.Pair;
41-
import com.cloud.utils.EnumUtils;
42-
import com.google.common.base.Joiner;
43-
import com.google.gson.Gson;
44-
import com.google.gson.GsonBuilder;
45-
46-
import org.apache.cloudstack.api.command.user.iso.GetUploadParamsForIsoCmd;
47-
import org.apache.cloudstack.api.command.user.template.GetUploadParamsForTemplateCmd;
48-
import org.apache.cloudstack.framework.async.AsyncCallFuture;
49-
import org.apache.cloudstack.storage.command.TemplateOrVolumePostUploadCommand;
50-
import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
51-
import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
52-
import org.apache.cloudstack.utils.imagestore.ImageStoreUtil;
53-
import org.apache.commons.collections.CollectionUtils;
54-
import org.apache.commons.collections.MapUtils;
55-
import org.apache.log4j.Logger;
5635
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
5736
import org.apache.cloudstack.api.ApiConstants;
5837
import org.apache.cloudstack.api.BaseListTemplateOrIsoPermissionsCmd;
5938
import org.apache.cloudstack.api.BaseUpdateTemplateOrIsoCmd;
6039
import org.apache.cloudstack.api.BaseUpdateTemplateOrIsoPermissionsCmd;
6140
import org.apache.cloudstack.api.command.user.iso.DeleteIsoCmd;
6241
import org.apache.cloudstack.api.command.user.iso.ExtractIsoCmd;
42+
import org.apache.cloudstack.api.command.user.iso.GetUploadParamsForIsoCmd;
6343
import org.apache.cloudstack.api.command.user.iso.ListIsoPermissionsCmd;
6444
import org.apache.cloudstack.api.command.user.iso.RegisterIsoCmd;
6545
import org.apache.cloudstack.api.command.user.iso.UpdateIsoCmd;
@@ -68,6 +48,7 @@
6848
import org.apache.cloudstack.api.command.user.template.CreateTemplateCmd;
6949
import org.apache.cloudstack.api.command.user.template.DeleteTemplateCmd;
7050
import org.apache.cloudstack.api.command.user.template.ExtractTemplateCmd;
51+
import org.apache.cloudstack.api.command.user.template.GetUploadParamsForTemplateCmd;
7152
import org.apache.cloudstack.api.command.user.template.ListTemplatePermissionsCmd;
7253
import org.apache.cloudstack.api.command.user.template.RegisterTemplateCmd;
7354
import org.apache.cloudstack.api.command.user.template.UpdateTemplateCmd;
@@ -94,6 +75,7 @@
9475
import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
9576
import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
9677
import org.apache.cloudstack.engine.subsystem.api.storage.ZoneScope;
78+
import org.apache.cloudstack.framework.async.AsyncCallFuture;
9779
import org.apache.cloudstack.framework.config.ConfigKey;
9880
import org.apache.cloudstack.framework.config.Configurable;
9981
import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
@@ -103,13 +85,22 @@
10385
import org.apache.cloudstack.storage.command.AttachCommand;
10486
import org.apache.cloudstack.storage.command.CommandResult;
10587
import org.apache.cloudstack.storage.command.DettachCommand;
88+
import org.apache.cloudstack.storage.command.TemplateOrVolumePostUploadCommand;
89+
import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
90+
import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
10691
import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
10792
import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
10893
import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
10994
import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
11095
import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreVO;
11196
import org.apache.cloudstack.storage.image.datastore.ImageStoreEntity;
11297
import org.apache.cloudstack.storage.to.TemplateObjectTO;
98+
import org.apache.cloudstack.utils.imagestore.ImageStoreUtil;
99+
import org.apache.commons.collections.CollectionUtils;
100+
import org.apache.commons.collections.MapUtils;
101+
import org.apache.log4j.Logger;
102+
import org.joda.time.DateTime;
103+
import org.joda.time.DateTimeZone;
113104

114105
import com.cloud.agent.AgentManager;
115106
import com.cloud.agent.api.Answer;
@@ -128,6 +119,7 @@
128119
import com.cloud.dc.DataCenter;
129120
import com.cloud.dc.DataCenterVO;
130121
import com.cloud.dc.dao.DataCenterDao;
122+
import com.cloud.deploy.DeployDestination;
131123
import com.cloud.domain.Domain;
132124
import com.cloud.domain.dao.DomainDao;
133125
import com.cloud.event.ActionEvent;
@@ -147,6 +139,7 @@
147139
import com.cloud.projects.ProjectManager;
148140
import com.cloud.storage.DataStoreRole;
149141
import com.cloud.storage.GuestOSVO;
142+
import com.cloud.storage.ImageStoreUploadMonitorImpl;
150143
import com.cloud.storage.LaunchPermissionVO;
151144
import com.cloud.storage.Snapshot;
152145
import com.cloud.storage.SnapshotVO;
@@ -185,6 +178,11 @@
185178
import com.cloud.user.ResourceLimitService;
186179
import com.cloud.user.dao.AccountDao;
187180
import com.cloud.uservm.UserVm;
181+
import com.cloud.utils.DateUtil;
182+
import com.cloud.utils.EncryptionUtil;
183+
import com.cloud.utils.EnumUtils;
184+
import com.cloud.utils.Pair;
185+
import com.cloud.utils.StringUtils;
188186
import com.cloud.utils.component.AdapterBase;
189187
import com.cloud.utils.component.ManagerBase;
190188
import com.cloud.utils.concurrency.NamedThreadFactory;
@@ -201,9 +199,9 @@
201199
import com.cloud.vm.VirtualMachineProfile;
202200
import com.cloud.vm.dao.UserVmDao;
203201
import com.cloud.vm.dao.VMInstanceDao;
204-
205-
import org.joda.time.DateTime;
206-
import org.joda.time.DateTimeZone;
202+
import com.google.common.base.Joiner;
203+
import com.google.gson.Gson;
204+
import com.google.gson.GsonBuilder;
207205

208206
public class TemplateManagerImpl extends ManagerBase implements TemplateManager, TemplateApiService, Configurable {
209207
private final static Logger s_logger = Logger.getLogger(TemplateManagerImpl.class);
@@ -1541,14 +1539,23 @@ public boolean updateTemplateOrIsoPermissions(BaseUpdateTemplateOrIsoPermissions
15411539
//Derive the domain id from the template owner as updateTemplatePermissions is not cross domain operation
15421540
Account owner = _accountMgr.getAccount(ownerId);
15431541
final Domain domain = _domainDao.findById(owner.getDomainId());
1542+
final boolean isCallerRootAdmin = _accountMgr.isRootAdmin(caller.getAccountId());
15441543
if ("add".equalsIgnoreCase(operation)) {
15451544
final List<String> accountNamesFinal = accountNames;
15461545
final List<Long> accountIds = new ArrayList<Long>();
15471546
Transaction.execute(new TransactionCallbackNoReturn() {
15481547
@Override
15491548
public void doInTransactionWithoutResult(TransactionStatus status) {
15501549
for (String accountName : accountNamesFinal) {
1551-
Account permittedAccount = _accountDao.findActiveAccount(accountName, domain.getId());
1550+
Account permittedAccount = null;
1551+
if (isCallerRootAdmin) {
1552+
List<AccountVO> accountsWthName = _accountDao.findAccountsLike(accountName);
1553+
if (accountsWthName.size() > 0) {
1554+
permittedAccount = accountsWthName.get(0);
1555+
}
1556+
} else {
1557+
permittedAccount = _accountDao.findActiveAccount(accountName, domain.getId());
1558+
}
15521559
if (permittedAccount != null) {
15531560
if (permittedAccount.getId() == caller.getId()) {
15541561
continue; // don't grant permission to the template
@@ -1563,8 +1570,8 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
15631570
} else {
15641571
throw new InvalidParameterValueException("Unable to grant a launch permission to account " + accountName + " in domain id=" +
15651572
domain.getUuid() + ", account not found. " + "No permissions updated, please verify the account names and retry.");
1566-
}
1567-
}
1573+
}
1574+
}
15681575
}
15691576
});
15701577

@@ -1578,7 +1585,15 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
15781585
} else if ("remove".equalsIgnoreCase(operation)) {
15791586
List<Long> accountIds = new ArrayList<Long>();
15801587
for (String accountName : accountNames) {
1581-
Account permittedAccount = _accountDao.findActiveAccount(accountName, domain.getId());
1588+
Account permittedAccount = null;
1589+
if (isCallerRootAdmin) {
1590+
List<AccountVO> accountsWthName = _accountDao.findAccountsLike(accountName);
1591+
if (accountsWthName.size() > 0) {
1592+
permittedAccount = accountsWthName.get(0);
1593+
}
1594+
} else {
1595+
permittedAccount = _accountDao.findActiveAccount(accountName, domain.getId());
1596+
}
15821597
if (permittedAccount != null) {
15831598
accountIds.add(permittedAccount.getId());
15841599
}

0 commit comments

Comments
 (0)