server: allow admins to blacklist vm details that users should not see#3213
server: allow admins to blacklist vm details that users should not see#3213yadvr merged 1 commit intoapache:masterfrom
Conversation
This introduces a new global setting `user.vm.blacklisted.details` that allows admins to blacklist VM details that non-admin users should not see via the VM's settings tab. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
|
@blueorangutan package |
|
@borisstoyanov a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-2656 |
|
@blueorangutan test |
|
@borisstoyanov a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
nvazquez
left a comment
There was a problem hiding this comment.
Code LGTM, subject to testing
|
Trillian test result (tid-3456)
|
|
LGTM |
Problem: The listVirtualMachines API response displays sensitive information which should not be visible to any other user which is not Root Admin.
Root Cause: There are currently no restrictions in place to control what
instance settings should be visible to Root Admin only.
Solution: The issue has been fixed by refactoring the response to filter details based on a global setting and also honour the cloud.user_vm_details table’s display field. The global setting used to hide details that Root admin can set is called
user.vm.blacklisted.detailswith the following defaults;• memoryOvercommitRatio
• cpuOvercommitRatio
• rootdisksize
• Message.ReservedCapacityFreed.Flag
Types of changes