Backups - GET backup - does not restrict access to the owner of the backup

[David Fecker]

Backups - GET backup - does not restrict access to the owner of the backup

Any user can "get" a backup from another user if they know the id of the backup

[Nikhil Manchanda (slicknik)]

Just reviewed the code and looks like this is an issue. We're not checking that the tenant who owns the backup is the same as the tenant who is trying to GET the backup by ID.

We need to fix this.

[David Fecker (david-fecker)]

This is also affecting deletes. The delete call is returning a 202 when trying to delete someone else's backup. But the delete actually fails as expected, probably in swift as the backup isn't truly available to a different user.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/32652

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/32652
Committed: http://github.com/openstack/trove/commit/4cdb10ebb3c52faa58e4594060480b252d3d7457
Submitter: Jenkins
Branch: master

commit 4cdb10ebb3c52faa58e4594060480b252d3d7457
Author: Nikhil Manchanda <email address hidden>
Date: Thu Jun 13 23:27:15 2013 -0700

    Fixed backups GET and DELETE to restrict access to the owner of backup

    Fixed the db model find_by so that when a model instance is looked up and a
    context is passed in, the find_by operation fails if the tenant_id in the
    instance is not the same as the tenant_id in the context (except if the
    tenant is an admin).

    Fixed bug 1188822

    Change-Id: I0374f999601fa3f2bc817901bbc428b8be219683