fanhuadesenlinnn/cloudpods
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/yunionio/cloudpods.git synced 2026-09-20 08:03:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent access from anonymous user (#21242)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2024-09-14 19:36:40 +08:00
committed by GitHub
parent 6acbf34d6b
commit 09e9ffb004
6 changed files with 51 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/keystone/models/rolepolicies.go
View File

@@ -353,7 +353,7 @@ func (manager *SRolePolicyManager) FetchCustomizeColumns(
func (manager *SRolePolicyManager) getMatchPolicyIds(userCred rbacutils.IRbacIdentity, tm time.Time) ([]string, error) {
isGuest := true
if userCred != nil && !auth.IsGuestToken(userCred) {
if userCred != nil && len(userCred.GetProjectId()) > 0 && len(userCred.GetRoleIds()) > 0 && !auth.IsGuestToken(userCred) {
isGuest = false
}
return manager.getMatchPolicyIds2(isGuest, userCred.GetRoleIds(), userCred.GetProjectId(), userCred.GetLoginIp(), tm)
@@ -437,6 +437,9 @@ func (p sUserProjectPair) GetProjectId() string {
}
func (p sUserProjectPair) GetRoleIds() []string {
if len(p.userId) == 0 || len(p.projectId) == 0 {
return nil
}
roles, _ := AssignmentManager.FetchUserProjectRoles(p.userId, p.projectId)
ret := make([]string, len(roles))
for i := range roles {
@@ -446,7 +449,7 @@ func (p sUserProjectPair) GetRoleIds() []string {
}
func (p sUserProjectPair) GetUserId() string {
return ""
return p.userId
}
func (p sUserProjectPair) GetLoginIp() string {
@@ -454,6 +457,9 @@ func (p sUserProjectPair) GetLoginIp() string {
}
func (p sUserProjectPair) GetTokenString() string {
if len(p.userId) == 0 {
return auth.GUEST_TOKEN
}
return p.userId
}
@@ -479,6 +485,7 @@ func (manager *SRolePolicyManager) GetMatchPolicyGroupByCred(ctx context.Context
userId := userCred.GetUserId()
if len(userId) == 0 {
// anonymous access
log.Debugf("anomymouse accessed policies: %s", jsonutils.Marshal(names))
return names, policies, nil
}
usr, err := UserManager.fetchUserById(userId)

2
pkg/keystone/tokens/policy.go
View File

@@ -19,6 +19,7 @@ import (
"net/http"
"time"
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
"yunion.io/x/pkg/util/rbacscope"
@@ -71,6 +72,7 @@ func doCheckPolicies(ctx context.Context, input mcclient.SCheckPoliciesInput) (*
if policy.PolicyManager.Allow(rbacscope.ScopeSystem, adminToken, api.SERVICE_TYPE, "tokens", "perform", "check_policies").Result.IsDeny() {
return nil, httperrors.NewForbiddenError("%s not allow to check policies", adminToken.GetUserName())
}
log.Debugf("doCheckPolicies userId: %s projectId: %s", input.UserId, input.ProjectId)
names, group, err := models.RolePolicyManager.GetMatchPolicyGroupByInput(ctx, input.UserId, input.ProjectId, time.Now(), false)
if err != nil {
return nil, errors.Wrap(err, "GetMatchPolicyGroupByInput")