Views accessible via url even if user doesn't match policy rules

[David Gutman]

When a user doesn't match the policy rules of a panel then the panel tab is removed from the menu of the left, but panel views are still accessible using directly the url (ex /admin/flavors/).

In most of the case, views won't work correctly because of the lack of right in the backend, but it may cause trouble when you play with policies.

I think it could be more elegant to return directly a "You are not authorized to access this page" from the frontend when user try to access a view of a panel (via url) without matching the policy rules.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/530928

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/530928
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=3f585d3b1efca1b2379d6c0a80246fd6e5a87640
Submitter: Zuul
Branch: master

commit 3f585d3b1efca1b2379d6c0a80246fd6e5a87640
Author: David Gutman <email address hidden>
Date: Wed Jan 3 14:25:46 2018 +0100

    Views accessible via url even if user doesn't match policy rules

    When a user doesn't match the policy rules of a panel then the panel tab
    is removed from the menu of the left, but panel views are still
    accessible using directly the url (ex /admin/flavors/).

    In most of the case, views won't work correctly because of the lack of
    right in the backend, but it may cause trouble when you play with
    policies.

    I think it could be more elegant to return directly a "You are not
    authorized to access this page" from the frontend when user try to
    access a view of a panel (via url) without matching the policy rules.

    Change-Id: I7bc93fed29568adfc14d5bcadfc8728d3b5cf633
    Closes-Bug: #1741051

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/horizon 13.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/542726

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/542746

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/542839

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Gutman (<email address hidden>) on branch: stable/pike
Review: https://review.openstack.org/542726
Reason: Replaced by an appropriate cherry pick with the expected tag. See review https://review.openstack.org/#/c/542839/

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Gutman (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/542746
Reason: Replaced by an appropriate cherry pick with the expected tag. See review https://review.openstack.org/#/c/542839/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/542845

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/542845
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=1870b536e20213b89122c5eded9ce0d40e572cfd
Submitter: Zuul
Branch: stable/pike

commit 1870b536e20213b89122c5eded9ce0d40e572cfd
Author: David Gutman <email address hidden>
Date: Wed Jan 3 14:25:46 2018 +0100

    Views accessible via url even if user doesn't match policy rules

    When a user doesn't match the policy rules of a panel then the panel tab
    is removed from the menu of the left, but panel views are still
    accessible using directly the url (ex /admin/flavors/).

    In most of the case, views won't work correctly because of the lack of
    right in the backend, but it may cause trouble when you play with
    policies.

    I think it could be more elegant to return directly a "You are not
    authorized to access this page" from the frontend when user try to
    access a view of a panel (via url) without matching the policy rules.

    Change-Id: I7bc93fed29568adfc14d5bcadfc8728d3b5cf633
    Closes-Bug: #1741051
    (cherry picked from commit 3f585d3b1efca1b2379d6c0a80246fd6e5a87640)

[OpenStack Infra (hudson-openstack)]

Change abandoned by David Gutman (<email address hidden>) on branch: stable/ocata
Review: https://review.openstack.org/542839
Reason: See the comment from Akihiro Motoki

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/horizon 12.0.3 release.