diff options
author | Jenkins <jenkins@review.openstack.org> | 2013-12-14 19:09:35 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2013-12-14 19:09:35 +0000 |
commit | 8283db76a441e25ae00315e1ebdbbeda90e08bf9 (patch) | |
tree | fa11f92f84594bb97246162e93d78550eec67a09 | |
parent | 0b1458a7a45926fbb9c4758b2c9d3a50803149ad (diff) | |
parent | 22f4fdafc0ac5cf86bd3b87faace5175fb8dc2c2 (diff) | |
download | heat-8283db76a441e25ae00315e1ebdbbeda90e08bf9.tar.gz |
Merge "Deny API requests where context doesn't match path" into stable/havana2013.2.1
-rw-r--r-- | heat/api/openstack/v1/util.py | 5 | ||||
-rw-r--r-- | heat/tests/test_api_openstack_v1.py | 12 | ||||
-rw-r--r-- | heat/tests/test_api_openstack_v1_util.py | 38 |
3 files changed, 43 insertions, 12 deletions
diff --git a/heat/api/openstack/v1/util.py b/heat/api/openstack/v1/util.py index b6dcdc5ed..ad311a8d9 100644 --- a/heat/api/openstack/v1/util.py +++ b/heat/api/openstack/v1/util.py @@ -21,12 +21,13 @@ from heat.common import identifier def tenant_local(handler): ''' - Decorator for a handler method that sets the correct tenant_id in the + Decorator for a handler method that checks the path matches the request context. ''' @wraps(handler) def handle_stack_method(controller, req, tenant_id, **kwargs): - req.context.tenant_id = tenant_id + if req.context.tenant_id != tenant_id: + raise exc.HTTPForbidden() return handler(controller, req, **kwargs) return handle_stack_method diff --git a/heat/tests/test_api_openstack_v1.py b/heat/tests/test_api_openstack_v1.py index 8f4197038..f970b005d 100644 --- a/heat/tests/test_api_openstack_v1.py +++ b/heat/tests/test_api_openstack_v1.py @@ -884,14 +884,6 @@ class StackControllerTest(ControllerTest, HeatTestCase): req = self._get('/stacks/%(stack_name)s/%(stack_id)s' % identity) - error = heat_exc.InvalidTenant(target='a', actual='b') - self.m.StubOutWithMock(rpc, 'call') - rpc.call(req.context, self.topic, - {'namespace': None, - 'method': 'show_stack', - 'args': {'stack_identity': dict(identity)}, - 'version': self.api_version}, - None).AndRaise(to_remote_error(error)) self.m.ReplayAll() resp = request_with_middleware(fault.FaultWrapper, @@ -900,8 +892,8 @@ class StackControllerTest(ControllerTest, HeatTestCase): stack_name=identity.stack_name, stack_id=identity.stack_id) - self.assertEqual(resp.json['code'], 403) - self.assertEqual(resp.json['error']['type'], 'InvalidTenant') + self.assertEqual(resp.status_int, 403) + self.assertIn('403 Forbidden', str(resp)) self.m.VerifyAll() def test_get_template(self): diff --git a/heat/tests/test_api_openstack_v1_util.py b/heat/tests/test_api_openstack_v1_util.py new file mode 100644 index 000000000..2af2b4e0f --- /dev/null +++ b/heat/tests/test_api_openstack_v1_util.py @@ -0,0 +1,38 @@ +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +from webob import exc + +from heat.api.openstack.v1 import util +from heat.common import context +from heat.common.wsgi import Request +from heat.tests.common import HeatTestCase + + +class TestTenantLocal(HeatTestCase): + def setUp(self): + super(TestTenantLocal, self).setUp() + self.req = Request({}) + self.req.context = context.RequestContext(tenant_id='foo') + + def test_tenant_local(self): + @util.tenant_local + def an_action(controller, req): + return 'woot' + + self.assertEqual('woot', + an_action(None, self.req, tenant_id='foo')) + + self.assertRaises(exc.HTTPForbidden, + an_action, None, self.req, tenant_id='bar') |