Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-28731

Filters are created as completely unlimited, ignoring organizations and locations set at the role level

XMLWordPrintable

    • Known Issue
    • Hide
      .Newly created filters do not inherit organizations and locations associated with the role

      When an organization and location are defined for a role, these organizations and locations are not propagated to the filters created within the role. Consequently, users with a role assigned can access resources in any other organization or location that they have sufficient permissions to view instead of only organizations and locations defined for the role.

      To work around the problem:

      1. Create your filter.
      2. Start editing the filter.
      3. Save the filter without making any changes. This ensures that organizations and locations defined on the role level are propagated to filters correctly.

      This known issue does not affect cloned roles. If you clone an existing role and assign organizations and locations to the cloned role, the organizations and locations are propagated to filters correctly.

      Note that defining organizations and locations on the filter level is deprecated. See xref:Jira-SAT-28820[].
      Show
      .Newly created filters do not inherit organizations and locations associated with the role When an organization and location are defined for a role, these organizations and locations are not propagated to the filters created within the role. Consequently, users with a role assigned can access resources in any other organization or location that they have sufficient permissions to view instead of only organizations and locations defined for the role. To work around the problem: 1. Create your filter. 2. Start editing the filter. 3. Save the filter without making any changes. This ensures that organizations and locations defined on the role level are propagated to filters correctly. This known issue does not affect cloned roles. If you clone an existing role and assign organizations and locations to the cloned role, the organizations and locations are propagated to filters correctly. Note that defining organizations and locations on the filter level is deprecated. See xref:Jira- SAT-28820 [].
    • Done
    • No Coverage

      Description of problem:
      Filters are created as completely unlimited, ignoring organizations and locations set at the role level.

      How reproducible:
      always

      Is this issue a regression from an earlier version:
      Doing some code archeology it seems this might have worked on 6.7 and earlier

      Steps to Reproduce:
      1. Have some organizations and locations with hosts placed in them
      2. Create a role
      3. Assign an organization and a location to the role
      4. Create a filter under the role to search on hosts, don't change anything in there
      5. Edit the filter, don't change anything, click submit

      Actual behavior:
      After step 4, the filter shows up as unlimited, if you look at it in the database, it has taxonomy_search field empty. After step 5, the filter no longer shows up as unlimited, in the db the taxonomy_search field is populated.

      When a user is given this role, they should be able to see hosts from other organizations than the one that is assigned to the role.

      Expected behavior:
      After step 4, the filter does not show up as unlimited, if you look at it in the database, it should have taxonomy_search field populated with a search query matching the organizations and locations from the role. After step 5, the situation is the same, no update happened.

      When a user is given this role, they should be able to see only hosts from the organizations to which the role is assigned.

      Business Impact / Additional info:

      Workaround
      Edit the filter after creating it without changing anything.

      Notes

      • The fix should contain a migration that would regenerate the taxonomy_search field of all filters which have override set to false to make them honor the organizations and locations set on the role. This might be surprising to users so this is probably worthy of having a RN

              magaphon@redhat.com Maria Agaphontzev
              aruzicka@redhat.com Adam Ruzicka
              Adam Ruzicka Adam Ruzicka
              Aneta Šteflová Petrová Aneta Šteflová Petrová
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: