Plugin v2 displays objects that have the "user-visible" field set to false
Bug #1700720 reported by
Bruno Fernando
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Juniper Openstack |
New
|
Undecided
|
Bruno Fernando | ||
| R3.2 |
In Progress
|
Undecided
|
Bruno Fernando | ||
| OpenContrail |
New
|
Undecided
|
Bruno Fernando | ||
Bug Description
Since all the requests made by the v2 plugin to the contrail API are set with the admin credentials, all the read/list operations (even the ones that are made with the regular openstack user "member") have full access to the objects, especially these that have the field "user_visible" set to false.
Contrail 3.2 and RBAC not enabled (multi-tenancy enabled)
| Changed in opencontrail: | |
| assignee: | nobody → Bruno Fernando (bfernando) |
| Changed in juniperopenstack: | |
| assignee: | nobody → Bruno Fernando (bfernando) |
| description: | updated |
| description: | updated |
Revision history for this message
| OpenContrail Admin (ci-admin-f) wrote [Review update] R3.2 | #1 |
To post a comment you must log in.
Review in progress for https:/
Submitter: Bruno Fernando (<email address hidden>)