Merge pull request #742 from MissionCriticalCloud/fix/project-ids-sho…

…w-all Only allow projectId -1 to Root Admin
MissionCriticalCloud · Jun 29, 2018 · 680d2ff · 680d2ff
2 parents 942a014 + bb9e6b2
commit 680d2ff
Show file tree

Hide file tree

Showing 2 changed files with 44 additions and 42 deletions.
diff --git a/cosmic-client/src/main/webapp/scripts/instances.js b/cosmic-client/src/main/webapp/scripts/instances.js
@@ -355,51 +355,43 @@
                     });
                 }
 
-                $.when(
-                    $.ajax({
-                        url: createURL('listVirtualMachines'),
-                        async: true,
-                        data: data,
-                        error: function (XMLHttpResponse) {
-                            cloudStack.dialog.notice({
-                                message: parseXMLHttpResponse(XMLHttpResponse)
-                            });
-                            args.response.error();
-                        }
-                    }),
-                    $.ajax({
-                        url: createURL('listVirtualMachines&projectid=-1'),
-                        async: true,
-                        data: data,
-                        error: function (XMLHttpResponse) {
-                            cloudStack.dialog.notice({
-                                message: parseXMLHttpResponse(XMLHttpResponse)
+                $.ajax({
+                    url: createURL('listVirtualMachines'),
+                    async: true,
+                    data: data,
+                    error: function (XMLHttpResponse) {
+                        cloudStack.dialog.notice({
+                            message: parseXMLHttpResponse(XMLHttpResponse)
+                        });
+                        args.response.error();
+                    },
+                    success: function (json) {
+                        var items = json.listvirtualmachinesresponse.virtualmachine;
+                        if (args.context.projects == null && isAdmin()) {
+                            $.ajax({
+                                url: createURL('listVirtualMachines&projectid=-1'),
+                                async: true,
+                                data: data,
+                                error: function (XMLHttpResponse) {
+                                    cloudStack.dialog.notice({
+                                        message: parseXMLHttpResponse(XMLHttpResponse)
+                                    });
+                                    args.response.error();
+                                },
+                                success: function (json) {
+                                    var pitems = json.listvirtualmachinesresponse.virtualmachine;
+                                    if (pitems) {
+                                        args.response.success({
+                                            data: pitems
+                                        });
+                                    }
+                                }
                             });
-                            args.response.error();
                         }
-                    })).done(function (jsonvm, jsonvmp) {
-                    var items = jsonvm[0].listvirtualmachinesresponse.virtualmachine;
-                    if (args.context.projects == null && isAdmin()) {
-                        var pitems = jsonvmp[0].listvirtualmachinesresponse.virtualmachine;
-                        if (pitems) {
-                            if (items) {
-                                items.push(pitems[0]);
-                            } else {
-                                items = pitems;
-                            }
-                        }
-                    }
-                    if (items) {
-                        $.each(items, function (idx, vm) {
-                            if (vm.nic && vm.nic.length > 0 && vm.nic[0].ipaddress) {
-                                items[idx].ipaddress = vm.nic[0].ipaddress;
-                            }
+                        args.response.success({
+                            data: items
                         });
-                    }
-                    args.response.success({
-                        data: items
-                    });
-                });
+                    }});
             },
 
             detailView: {

diff --git a/cosmic-core/api/src/main/java/com/cloud/api/BaseListProjectAndAccountResourcesCmd.java b/cosmic-core/api/src/main/java/com/cloud/api/BaseListProjectAndAccountResourcesCmd.java
@@ -1,6 +1,9 @@
 package com.cloud.api;
 
 import com.cloud.api.response.ProjectResponse;
+import com.cloud.context.CallContext;
+import com.cloud.legacymodel.exceptions.PermissionDeniedException;
+import com.cloud.legacymodel.user.Account;
 
 public abstract class BaseListProjectAndAccountResourcesCmd extends BaseListAccountResourcesCmd implements IBaseListProjectAndAccountResourcesCmd {
 
@@ -9,6 +12,13 @@ public abstract class BaseListProjectAndAccountResourcesCmd extends BaseListAcco
 
     @Override
     public Long getProjectId() {
+        // Only allow root admin to see all project resources
+        final Account caller = CallContext.current().getCallingAccount();
+        if (projectId != null) {
+            if (caller.getType() != Account.ACCOUNT_TYPE_ADMIN && projectId == -1L) {
+                throw new PermissionDeniedException("Not allowed to access this project");
+            }
+        }
         return projectId;
     }
 }