Github user ustcweizhou commented on the pull request:
https://github.com/apache/cloudstack/pull/508#issuecomment-158342455
@pdube
you may notice this code in UserVmManagerImpl.java
_accountMgr.checkAccess(caller, null, true, owner, ag);
normally it will check
(1) caller can access owner
(2) caller can access/modify ag (affinity group)
(3) The account of owner and ag are the same.
I guess you have modified the account of ag (when create an affinity group
from project view) from account to project account of project. If yes, the (2)
will fail, because affinity group has special AccessChecker that the caller can
only be the account of the affinity group. However, when we log in as Account A
and go to Project view, the call is A, not the project account of the project.
Do you need my help to fix the issues or test the changes ?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
