backup list on an instance, shows backups owned by other tenants

Bug #1295325 reported by Saurabh Surana
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack DBaaS (Trove)
Fix Released
High
Nikhil Manchanda

Bug Description

When we try to get backups list for an instance, it lists all the backups of that instance which are even owned by the other tenants.

curl -X GET -i http://10.0.0.1:8779/v1.0/<TenantID>/instances/<Instance ID>/backups

When it returns that list, the backups that are owned by other tenants are anyways not usable by regular users (regular user cannot delete the backups owned by other user or they cannot restore from such backups either, as regular user will not have access to remote user's swift account).

So such complete list should be returned only for the admin user and for regular users we should return the list of backups that are owned by them only.

Changed in trove:
status: New → Triaged
importance: Undecided → High
milestone: none → juno-1
assignee: nobody → Nikhil Manchanda (slicknik)
Changed in trove:
milestone: juno-1 → juno-2
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to trove (master)

Fix proposed to branch: master
Review: https://review.openstack.org/107536

Changed in trove:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to trove (master)

Reviewed: https://review.openstack.org/107536
Committed: https://git.openstack.org/cgit/openstack/trove/commit/?id=5ebbd7867ebf061f2d4ec7f4b86b385e4bb8fcf5
Submitter: Jenkins
Branch: master

commit 5ebbd7867ebf061f2d4ec7f4b86b385e4bb8fcf5
Author: Nikhil Manchanda <email address hidden>
Date: Wed Jul 16 17:13:04 2014 -0700

    Restrict backup-list on instance to tenant

    Fixed backup-list on an instance, so that we show all available backups for
    the instance iff the user making the request is an admin. For a non-admin
    user, we return only the backups in his particular tenant.

    Change-Id: I2aff6dca053d8261bb70083bf52dac46806faabe
    Closes-bug: 1295325

Changed in trove:
status: In Progress → Fix Committed
Changed in trove:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in trove:
milestone: juno-2 → 2014.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.