HawkForge commented on PR #14428:
URL: https://github.com/apache/cloudstack/pull/14428#issuecomment-6221732913
Thanks for looking at it. I think it's a bug rather than intended behaviour,
for three reasons:
1. **Registration and update disagree.** When a template is registered into
a project, `TemplateAdapterBase.prepare()` lets the caller set `ispublic` /
`isextractable` as long as `allow.public.user.templates` allows it for the
template owner (the project account). There is no project-role check there.
After registration, `updateTemplateOrIsoPermissions()` refuses the same flags
to everyone except root/domain admins. So nobody in the project can change them.
2. **The project can't undo its own choice.** A template that was registered
as public can't be made private again by the project's own admin. Only an
operator can. That seems unlikely to be the intended permission model.
3. **The method already expects project users to get past this point.** It
has a project-specific branch, `if (owner.getType() == Account.Type.PROJECT) {
// if it is a project owned template/iso, the user must at least have access to
be allowed to share it. _accountMgr.checkAccess(user, template); }`. But the
owner check that follows compares `caller.getId()` with the template's owner,
which is the project account. No user's own account is ever the project
account, so for non-admin callers that branch can never lead to success.
The change keeps this narrow. It only treats a caller as owner when the
template is project-owned and `ProjectManager.canModifyProjectAccount()` says
they may modify that project account, which for regular users means the
project's Admin role. Plain project members are still refused (there is a test
for that), and nothing changes for templates owned by normal accounts.
If you'd rather keep this admin-only by design, I'm happy to close this. It
would probably be worth making registration consistent with that, though.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
