Project

General

Profile

Actions

Bug #22618

open

Granular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions

Added by Ondřej Pražák over 6 years ago. Updated over 6 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Search
Target version:
-
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

Description of problem:
When users create custom roles where filters contain ^ and !^ operators in search query, the UI will start showing many SQL exceptions because the operators are wrongly translated to the SQL language.

~~
PG::Error: ERROR: missing FROM-clause entry for table "taxonomies" LINE 1: ...) AND "hosts"."location_id" IN (5, 8, 2, 6) AND (("taxonomie... ^ : SELECT COUNT FROM (SELECT DISTINCT "katello_errata"."id" AS count_column FROM "katello_errata" INNER JOIN "katello_content_facet_errata" ON "katello_content_facet_errata"."erratum_id" = "katello_errata"."id" INNER JOIN "katello_content_facets" ON "katello_content_facets"."id" = "katello_content_facet_errata"."content_facet_id" WHERE "katello_content_facets"."host_id" IN (SELECT "hosts"."id" FROM "hosts" WHERE "hosts"."type" IN ('Host::Managed') AND "hosts"."organization_id" IN (3) AND "hosts"."location_id" IN (5, 8, 2, 6) AND (("taxonomies"."title" = 'test'))) LIMIT 6) subquery_for_count
~~

~~
PG::Error: ERROR: syntax error at or near "'test-'" LINE 9: ...locks_owner.resource_id = 8) OR (users."login" IN 'test-') O... ^ : SELECT DISTINCT foreman_tasks_tasks.*, "foreman_tasks_tasks"."id" AS t0_r0, "foreman_tasks_tasks"."type" AS t0_r1, "foreman_tasks_tasks"."label" AS t0_r2, "foreman_tasks_tasks"."started_at" AS t0_r3, "foreman_tasks_tasks"."ended_at" AS t0_r4, "foreman_tasks_tasks"."state" AS t0_r5, "foreman_tasks_tasks"."result" AS t0_r6, "foreman_tasks_tasks"."external_id" AS t0_r7, "foreman_tasks_tasks"."parent_task_id" AS t0_r8, "foreman_tasks_tasks"."start_at" AS t0_r9, "foreman_tasks_tasks"."start_before" AS t0_r10 FROM "foreman_tasks_tasks" INNER JOIN foreman_tasks_locks AS foreman_tasks_locks_owner ON (foreman_tasks_locks_owner.task_id = foreman_tasks_tasks.id AND foreman_tasks_locks_owner.resource_type = 'User' AND foreman_tasks_locks_owner.name = 'task_owner') INNER JOIN foreman_tasks_locks AS foreman_tasks_locks_owner ON (foreman_tasks_locks_owner.task_id = foreman_tasks_tasks.id AND foreman_tasks_locks_owner.resource_type = 'User' AND foreman_tasks_locks_owner.name = 'task_owner') INNER JOIN users ON (users.id = foreman_tasks_locks_owner.resource_id) WHERE (((foreman_tasks_locks_owner.resource_id = 8) OR (users."login" IN 'test-') OR (users."login" = 'foreman_admin'))) ORDER BY "foreman_tasks_tasks"."started_at" DESC NULLS LAST LIMIT 20 OFFSET 0
~~

How reproducible:
Apply the attached set of rules and create a user with the role, you have created. Then login as the newly created user.

Steps to Reproduce:
1. Download the org-perms-default.sh
2. Edit it and set the unit and unit_org_id (unit = organization, unit_org_id = organization id)
3. Run the org-perms-default.sh
4. Create an user with org-admin-${unit} role
5. Login as the newly created user and try access these pages:
https://$(hostname)/dashboard
https://$(hostname)/foreman_tasks/tasks

Actual results:
Hitting the errors.

Expected results:
All the pages will be displayed correctly respecting the role search rules.


Files

org-perms-default.sh org-perms-default.sh 16.6 KB Ondřej Pražák, 02/19/2018 04:10 PM
Actions #1

Updated by Ondřej Pražák over 6 years ago

  • File org-perms-default.sh org-perms-default.sh added
  • Subject changed from Granular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions to Granular permission filtering rules: operators are wrongly translated to SQL causing SQL exceptions
  • Category set to Search
Actions

Also available in: Atom PDF