From 1356988b7a40a60af39807db143860efb4a2f435 Mon Sep 17 00:00:00 2001 From: Ondrej Hamada Date: Wed, 29 Feb 2012 11:40:31 +0100 Subject: Validate attributes in permission-add When adding or modifying permission with both type and attributes specified, check whether the attributes are allowed for specified type. In case of disallowed attributes raises the ObjectclassViolation exception. New tests were also added to the unit-tests. https://fedorahosted.org/freeipa/ticket/2293 --- ipalib/plugins/permission.py | 55 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) (limited to 'ipalib/plugins/permission.py') diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py index 08781ce2..c9fd5649 100644 --- a/ipalib/plugins/permission.py +++ b/ipalib/plugins/permission.py @@ -23,6 +23,7 @@ from ipalib import api, _, ngettext from ipalib import Flag, Str, StrEnum from ipalib.request import context from ipalib import errors +from ipalib.dn import DN __doc__ = _(""" Permissions @@ -89,6 +90,43 @@ output_params = ( ), ) +dn_ipaconfig = str(DN('cn=ipaconfig,cn=etc,%s' % api.env.basedn)) + +def check_attrs(attrs, type): + # Trying to delete attributes - no need for validation + if attrs is None: + return True + allowed_objcls=[] + disallowed_objcls=[] + obj=api.Object[type] + + if obj.object_class_config: + (dn,objcls)=api.Backend.ldap2.get_entry( + dn_ipaconfig,[obj.object_class_config] + ) + allowed_objcls=objcls[obj.object_class_config] + else: + allowed_objcls=obj.object_class + if obj.possible_objectclasses: + allowed_objcls+=obj.possible_objectclasses + if obj.disallow_object_classes: + disallowed_objcls=obj.disallow_object_classes + + allowed_attrs=[] + disallowed_attrs=[] + if allowed_objcls: + allowed_attrs=api.Backend.ldap2.get_allowed_attributes(allowed_objcls) + if disallowed_objcls: + disallowed_attrs=api.Backend.ldap2.get_allowed_attributes(disallowed_objcls) + failed_attrs=[] + for attr in attrs: + if (attr not in allowed_attrs) or (attr in disallowed_attrs): + failed_attrs.append(attr) + if failed_attrs: + raise errors.ObjectclassViolation(info='attribute(s) \"%s\" not allowed' % ','.join(failed_attrs)) + return True + + class permission(LDAPObject): """ Permission object. @@ -192,6 +230,8 @@ class permission_add(LDAPCreate): opts['permission'] = keys[-1] opts['aciprefix'] = ACI_PREFIX try: + if 'type' in entry_attrs and 'attrs' in entry_attrs: + check_attrs(entry_attrs['attrs'],entry_attrs['type']) self.api.Command.aci_add(keys[-1], **opts) except Exception, e: raise e @@ -273,6 +313,21 @@ class permission_mod(LDAPUpdate): except errors.NotFound: self.obj.handle_not_found(*keys) + # check the correctness of attributes only when the type is specified + type=None + attrs_to_check=[] + current_values=self.api.Command.permission_show(attrs['cn'][0])['result'] + if 'type' in entry_attrs: + type = entry_attrs['type'] + elif 'type' in current_values: + type = current_values['type'] + if 'attrs' in entry_attrs: + attrs_to_check = entry_attrs['attrs'] + elif 'attrs' in current_values: + attrs_to_check = current_values['attrs'] + if attrs_to_check and type is not None: + check_attrs(attrs_to_check,type) + # when renaming permission, check if the target permission does not # exists already. Then, make changes to underlying ACI if 'rename' in options: -- cgit