MAAS

get_machine_edit_form not validating from RBAC

Bug #1825104 reported by Lee Trager
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MAAS
Triaged
Medium
Unassigned
MAAS 3.5.x

Bug Description

The MAAS websocket and API both use get_machine_edit_form, get_node_edit_form, and get_machine_create_form to determine which form should be used when editing or creating a Node/Machine. The function only checks admin status with user.is_superuser, it should be using user.has_perm(NodePermission.admin, node)

Tags: rbac
Alberto Donato (ack)
Changed in maas:
status: New → Triaged
Jerzy Husakowski (jhusakowski)
summary: - [RBAC] get_machine_edit_form not validating from RBAC
+ get_machine_edit_form not validating from RBAC
Changed in maas:
importance: Undecided → Medium
milestone: 2.6.0 → 3.5.0
Anton Troyanov (troyanov)
Changed in maas:
milestone: 3.5.0 → 3.5.x
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.