From 902755cd02f731a13439bb5716a06a7a7d2908cb Mon Sep 17 00:00:00 2001 From: davidjumani Date: Mon, 15 Jun 2020 11:39:23 +0530 Subject: [PATCH 1/3] Fixing listVirtualMachinesMetrics to extend ListVMsCmd instead of ListVMsCmdByAdmin --- .../java/org/apache/cloudstack/api/ListVMsMetricsCmd.java | 4 ++-- .../src/main/java/com/cloud/api/query/QueryManagerImpl.java | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/plugins/metrics/src/main/java/org/apache/cloudstack/api/ListVMsMetricsCmd.java b/plugins/metrics/src/main/java/org/apache/cloudstack/api/ListVMsMetricsCmd.java index 1cec5a316129..9b8564c2c8b3 100644 --- a/plugins/metrics/src/main/java/org/apache/cloudstack/api/ListVMsMetricsCmd.java +++ b/plugins/metrics/src/main/java/org/apache/cloudstack/api/ListVMsMetricsCmd.java @@ -18,7 +18,7 @@ package org.apache.cloudstack.api; import org.apache.cloudstack.acl.RoleType; -import org.apache.cloudstack.api.command.admin.vm.ListVMsCmdByAdmin; +import org.apache.cloudstack.api.command.user.vm.ListVMsCmd; import org.apache.cloudstack.api.response.ListResponse; import org.apache.cloudstack.api.response.UserVmResponse; import org.apache.cloudstack.metrics.MetricsService; @@ -30,7 +30,7 @@ @APICommand(name = ListVMsMetricsCmd.APINAME, description = "Lists VM metrics", responseObject = VmMetricsResponse.class, requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, responseView = ResponseObject.ResponseView.Full, since = "4.9.3", authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}) -public class ListVMsMetricsCmd extends ListVMsCmdByAdmin { +public class ListVMsMetricsCmd extends ListVMsCmd { public static final String APINAME = "listVirtualMachinesMetrics"; @Inject diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java index fae76122f076..5399f79313ba 100644 --- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java +++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java @@ -781,7 +781,8 @@ public ListResponse searchForUserVMs(ListVMsCmd cmd) { Pair, Integer> result = searchForUserVMsInternal(cmd); ListResponse response = new ListResponse(); ResponseView respView = ResponseView.Restricted; - if (cmd instanceof ListVMsCmdByAdmin) { + Account caller = CallContext.current().getCallingAccount(); + if (_accountMgr.isAdmin(caller.getId())) { respView = ResponseView.Full; } List vmResponses = ViewResponseHelper.createUserVmResponse(respView, "virtualmachine", cmd.getDetails(), result.first().toArray(new UserVmJoinVO[result.first().size()])); From a0d194ee0036c16a333b0678027c71b0c246ed95 Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Tue, 16 Jun 2020 09:58:40 +0530 Subject: [PATCH 2/3] Update QueryManagerImpl.java --- server/src/main/java/com/cloud/api/query/QueryManagerImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java index 5399f79313ba..f06c26e69202 100644 --- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java +++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java @@ -782,7 +782,7 @@ public ListResponse searchForUserVMs(ListVMsCmd cmd) { ListResponse response = new ListResponse(); ResponseView respView = ResponseView.Restricted; Account caller = CallContext.current().getCallingAccount(); - if (_accountMgr.isAdmin(caller.getId())) { + if (_accountMgr.isRootAdmin(caller.getId())) { respView = ResponseView.Full; } List vmResponses = ViewResponseHelper.createUserVmResponse(respView, "virtualmachine", cmd.getDetails(), result.first().toArray(new UserVmJoinVO[result.first().size()])); From cab6a07325b99a063c36156edf3f64db98ccefba Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Tue, 16 Jun 2020 10:05:28 +0530 Subject: [PATCH 3/3] clusterid/pod/storage pool etc should not be returned to domain admin --- server/src/main/java/com/cloud/api/query/QueryManagerImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java index f06c26e69202..b1eec78f58de 100644 --- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java +++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java @@ -1692,7 +1692,7 @@ public ListResponse searchForVolumes(ListVolumesCmd cmd) { ResponseView respView = ResponseView.Restricted; Account account = CallContext.current().getCallingAccount(); - if (_accountMgr.isAdmin(account.getAccountId())) { + if (_accountMgr.isRootAdmin(account.getAccountId())) { respView = ResponseView.Full; }