A share export location can be retrieved from any project when its ID is known

[Daria Fortunato]

Description
===========

If a share export location ID becomes known, it is possible to get information about it from another project even if a user has no admin rights (like context.is_admin=True).

Steps to reproduce
==================

* Create a share inside a project A
* Get share' export locations
* Create a share inside a project B
* Try to get one of export locations from the first share (from project A) using second share (from project B) inside the URL path

GET /v2/{project_B}/shares/{share_from_project_B}/export_locations/​{export_location_from_project_A}​

Expected result
===============

The export location should not be returned.

Actual result
=============

Share export location information is returned.

Environment

===========

Manila version: 2024.1 Caracal

N.B. I didn't see any new changes inside `master` branch that would prevent this from happening inside newer versions.

I'll try to submit a patch to fix this.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/manila/+/957856

[Daria Fortunato (dkobtsev)]

I've submitted a code fix here: https://review.opendev.org/c/openstack/manila/+/957856

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/957856
Committed: https://opendev.org/openstack/manila/commit/e153f284a5c3a3801a3d9805da0f5070a6a75d5b
Submitter: "Zuul (22348)"
Branch: master

commit e153f284a5c3a3801a3d9805da0f5070a6a75d5b
Author: Daria Kobtseva <email address hidden>
Date: Tue Aug 19 09:22:23 2025 +0000

    Update show share export location to return 404 error when the location does not belong to the share

    When a share export location does not belong to the share,
    the API service should return 404 Not Found.

    Closes-bug: #2120921
    Change-Id: Ic47b4cdeac17baf10ef3612ed6ac6e663d6ef41a
    Signed-off-by: Daria Kobtseva <email address hidden>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/manila/+/978857

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/978857
Committed: https://opendev.org/openstack/manila/commit/76dcba7a11cb4a630bd3a8ee8d516ebb3cacaf04
Submitter: "Zuul (22348)"
Branch: master

commit 76dcba7a11cb4a630bd3a8ee8d516ebb3cacaf04
Author: Goutham Pacha Ravi <email address hidden>
Date: Wed Mar 4 00:16:30 2026 -0800

    Fix potential double join in export locs query

    Commit e153f284a5c3a3801a3d9805da0f5070a6a75d5b introduced
    a share ownership check on share instance export locations
    via a DB query. However, a pre-existing join was ignored
    which could cause two separate join statements in the
    eventual SQL query.

    Also address some incorrect unit test modifications
    made in the same change.

    Partial-Bug: #2120921
    Change-Id: Iff6f80f41ffbbe93643aeae5f13d8a1c85d6aff7
    Signed-off-by: Goutham Pacha Ravi <email address hidden>