gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-09-02 17:40:22 +00:00
Code Issues Actions 24 Packages Projects Releases Wiki Activity

add access validation for the deleteUserData, linkUserDataToTemplate and resetUserDataForVirtualMachine APIs

Browse Source
This commit is contained in:
Bernardo De Marco Gonçalves 2026-05-14 18:32:10 -03:00 committed by Abhishek Kumar
parent 0459833631
commit 8985a1fc7c
6 changed files with 51 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
api/src/main/java/org/apache/cloudstack/api/command/user/userdata/DeleteUserDataCmd.java
View File

@ -17,6 +17,8 @@
package org.apache.cloudstack.api.command.user.userdata;
import org.apache.cloudstack.acl.RoleType;
import org.apache.cloudstack.acl.SecurityChecker;
import org.apache.cloudstack.api.ACL;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiConstants;
import org.apache.cloudstack.api.ApiErrorCode;
@ -27,7 +29,6 @@ import org.apache.cloudstack.api.response.DomainResponse;
import org.apache.cloudstack.api.response.ProjectResponse;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.api.response.UserDataResponse;
import org.apache.cloudstack.context.CallContext;
import com.cloud.user.Account;
import com.cloud.user.UserData;
@ -43,6 +44,7 @@ public class DeleteUserDataCmd extends BaseCmd {
//////////////// API parameters /////////////////////
/////////////////////////////////////////////////////
@ACL(accessType = SecurityChecker.AccessType.OperateEntry)
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, required = true, entityType = UserDataResponse.class, description = "The ID of the Userdata")
private Long id;
@ -97,18 +99,13 @@ public class DeleteUserDataCmd extends BaseCmd {
@Override
public long getEntityOwnerId() {
Account account = CallContext.current().getCallingAccount();
if ((account == null || _accountService.isAdmin(account.getId())) && (domainId != null && accountName != null)) {
Account userAccount = _responseGenerator.findAccountByNameDomain(accountName, domainId);
if (userAccount != null) {
return userAccount.getId();
if (id != null) {
UserData userData = _entityMgr.findById(UserData.class, id);
if (userData != null) {
return userData.getAccountId();
}
}
if (account != null) {
return account.getId();
}
return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked
}
}

31
api/src/test/java/org/apache/cloudstack/api/command/user/userdata/DeleteUserDataCmdTest.java
View File

@ -17,11 +17,11 @@
package org.apache.cloudstack.api.command.user.userdata;
import com.cloud.server.ManagementService;
import com.cloud.user.Account;
import com.cloud.user.AccountService;
import com.cloud.user.UserData;
import com.cloud.utils.db.EntityManager;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.response.SuccessResponse;
import org.apache.cloudstack.context.CallContext;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
@ -29,7 +29,6 @@ import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.MockedStatic;
import org.mockito.Mockito;
import org.mockito.MockitoAnnotations;
import org.mockito.junit.MockitoJUnitRunner;
@ -46,6 +45,12 @@ public class DeleteUserDataCmdTest {
@Mock
ManagementService _mgr;
@Mock
private EntityManager entityManagerMock;
@Mock
private UserData userDataMock;
private static final long DOMAIN_ID = 5L;
private static final long PROJECT_ID = 10L;
private static final String ACCOUNT_NAME = "user";
@ -84,19 +89,13 @@ public class DeleteUserDataCmdTest {
}
@Test
public void validateArgsCmd() {
try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
CallContext callContextMock = Mockito.mock(CallContext.class);
callContextMocked.when(CallContext::current).thenReturn(callContextMock);
Account accountMock = Mockito.mock(Account.class);
Mockito.when(callContextMock.getCallingAccount()).thenReturn(accountMock);
Mockito.when(accountMock.getId()).thenReturn(2L);
Mockito.doReturn(false).when(_accountService).isAdmin(2L);
public void getEntityOwnerIdTestReturnUserDataOwnerWhenUserDataIdIsProvided() {
long userDataId = 1L;
long userDataOwnerId = 2L;
ReflectionTestUtils.setField(cmd, "id", userDataId);
Mockito.when(entityManagerMock.findById(UserData.class, userDataId)).thenReturn(userDataMock);
Mockito.when(userDataMock.getAccountId()).thenReturn(userDataOwnerId);
ReflectionTestUtils.setField(cmd, "id", 1L);
Assert.assertEquals(1L, (long) cmd.getId());
Assert.assertEquals(2L, cmd.getEntityOwnerId());
}
Assert.assertEquals(userDataOwnerId, cmd.getEntityOwnerId());
}
}

11
server/src/main/java/com/cloud/template/TemplateManagerImpl.java
View File

@ -36,6 +36,7 @@ import javax.naming.ConfigurationException;
import com.cloud.cpu.CPU;
import com.cloud.resourcelimit.CheckedReservation;
import com.cloud.user.dao.UserDataDao;
import com.cloud.utils.UriUtils;
import org.apache.cloudstack.acl.SecurityChecker.AccessType;
import org.apache.cloudstack.api.ApiConstants;
@ -329,6 +330,9 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
@Inject
private ReservationDao reservationDao;
@Inject
private UserDataDao userDataDao;
private TemplateAdapter getAdapter(HypervisorType type) {
TemplateAdapter adapter = null;
if (type == HypervisorType.BareMetal) {
@ -2532,12 +2536,17 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
_accountMgr.checkAccess(caller, AccessType.OperateEntry, true, template);
template.setUserDataId(userDataId);
if (userDataId != null) {
UserData userData = userDataDao.findById(userDataId);
if (userData == null) {
throw new InvalidParameterValueException("Unable to find user data with the specified ID.");
}
_accountMgr.checkAccess(caller, null, false, userData);
template.setUserDataLinkPolicy(overridePolicy);
} else {
template.setUserDataLinkPolicy(null);
}
template.setUserDataId(userDataId);
_tmpltDao.update(template.getId(), template);
return _tmpltDao.findById(template.getId());

10
server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
View File

@ -965,8 +965,16 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
throw new InvalidParameterValueException(String.format("VM %s should be stopped to do UserData reset", userVm));
}
String userData = cmd.getUserData();
Long userDataId = cmd.getUserdataId();
if (userDataId != null) {
UserData userData = userDataDao.findById(userDataId);
if (userData == null) {
throw new InvalidParameterValueException("Unable to find user data with the specified ID.");
}
_accountMgr.checkAccess(caller, null, false, userData);
}
String userData = cmd.getUserData();
String userDataDetails = null;
if (MapUtils.isNotEmpty(cmd.getUserdataDetails())) {
userDataDetails = cmd.getUserdataDetails().toString();

10
server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
View File

@ -50,7 +50,9 @@ import com.cloud.user.AccountVO;
import com.cloud.user.ResourceLimitService;
import com.cloud.user.User;
import com.cloud.user.UserData;
import com.cloud.user.UserDataVO;
import com.cloud.user.UserVO;
import com.cloud.user.dao.UserDataDao;
import com.cloud.utils.UriUtils;
import com.cloud.utils.concurrency.NamedThreadFactory;
import com.cloud.utils.exception.CloudRuntimeException;
@ -180,6 +182,12 @@ public class TemplateManagerImplTest extends TestCase {
@Mock
HeuristicRuleHelper heuristicRuleHelperMock;
@Mock
private UserDataDao userDataDaoMock;
@Mock
private UserDataVO userDataMock;
public class CustomThreadPoolExecutor extends ThreadPoolExecutor {
AtomicInteger ai = new AtomicInteger(0);
public CustomThreadPoolExecutor(int corePoolSize, int maximumPoolSize, long keepAliveTime, TimeUnit unit,
@ -484,6 +492,8 @@ public class TemplateManagerImplTest extends TestCase {
VMTemplateVO template = Mockito.mock(VMTemplateVO.class);
when(vmTemplateDao.findById(anyLong())).thenReturn(template);
when(userDataDaoMock.findById(anyLong())).thenReturn(userDataMock);
VirtualMachineTemplate resultTemplate = templateManager.linkUserDataToTemplate(cmd);
Assert.assertEquals(template, resultTemplate);

1
server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
View File

@ -949,7 +949,6 @@ public class UserVmManagerImplTest {
when(userVmVoMock.getState()).thenReturn(VirtualMachine.State.Stopped);
when(cmd.getUserData()).thenReturn("testUserdata");
when(cmd.getUserdataId()).thenReturn(1L);
try {