User from not admin tenant can make own application public

Bug #1436289 reported by Vlad Naboichenko
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Murano
Fix Released
Medium
Kirill Zaitsev

Bug Description

With this policy.json non-admin user can make own application public.

/etc/murano/policy.json

{
    "context_is_admin": "role:admin",
    "admin_api": "is_admin:True",
    "default": "",

    "publicize_package": "rule:admin_api",
    "publicize_image": "rule:admin_api"
}

Changed in murano:
status: New → Confirmed
assignee: nobody → Ekaterina Chernova (efedorova)
importance: Undecided → Medium
milestone: none → kilo-rc1
assignee: Ekaterina Chernova (efedorova) → nobody
Changed in murano:
assignee: nobody → Kirill Zaitsev (kzaitsev)
status: Confirmed → In Progress
Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to murano (master)

Reviewed: https://review.openstack.org/170126
Committed: https://git.openstack.org/cgit/stackforge/murano/commit/?id=4732a4dec5e905b9deb9a6c3e2946acf38e864bb
Submitter: Jenkins
Branch: master

commit 4732a4dec5e905b9deb9a6c3e2946acf38e864bb
Author: Ekaterina Chernova <email address hidden>
Date: Thu Apr 2 16:39:13 2015 +0300

    Update default policy settings

    Also, there were some issues with policy:
    * 'publicize_image' instead of 'publicize_package';
    * corresponding actions have different names;
    * user could not upload packages by default;
    * user could mark package public/unpublic;
    * user could delete pablic packages.

    Change-Id: I5459016a4e7401b58fcb343e40d0047a4959b7df
    Closes-Bug: #1439240
    Closes-Bug: #1436289

Changed in murano:
status: In Progress → Fix Committed
Changed in murano:
status: Fix Committed → Fix Released
Changed in murano:
milestone: kilo-rc1 → 2015.1.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.