ref: refs/heads/master commit 98361575ad526439cfa8d4f243b023c88c19ece3 Author: Klaus Kämpf Date: Tue Jul 7 14:46:55 2009 +0200 Test with permission checks enabled --- .../app/controllers/permissions_controller.rb | 117 +++++++++----------- .../test/functional/permissions_controller_test.rb | 83 ++++++++++---- 2 files changed, 111 insertions(+), 89 deletions(-) diff --git a/webservice/app/controllers/permissions_controller.rb b/webservice/app/controllers/permissions_controller.rb index 6319a2f..d22cb8c 100644 --- a/webservice/app/controllers/permissions_controller.rb +++ b/webservice/app/controllers/permissions_controller.rb @@ -1,63 +1,59 @@ +# +# +# + class PermissionsController < ApplicationController before_filter :login_required require "scr" -#-------------------------------------------------------------------------------- -# -#local methods -# -#-------------------------------------------------------------------------------- - + private def get_permission_list(user_id, filter = nil) - ok = true - @permissions = [] - ret = Scr.instance.execute(["polkit-action"]) - if ret[:exit] == 0 - suse_string = "org.opensuse.yast." - lines = ret[:stdout].split "\n" - - # a hash for mapping string 'permission name' => boolean 'granted' - perms = Hash.new - - lines.each do |s| - if (s.include?( suse_string )) && - (filter.blank? || s.include?( filter )) - # set 'not granted' default - perms[s] = false - end - end - - ret = Scr.instance.execute(["polkit-auth", "--user", user_id, "--explicit"]) - if ret[:exit] == 0 - lines = ret[:stdout].split "\n" - lines.each do |s| - # ignore the rights which do not have the prefix, do not have any .policy file - # or do not match the filter - if (s.include?( suse_string )) && perms.has_key?(s) && (filter.blank? || s.include?( filter )) - # update the value to 'granted' state - perms[s] = true - end - end - - # convert the hash to a list of Permission objects - @permissions = [] - perms.each do |name,value| - permission = Permission.new - permission.name = name - permission.grant = value - @permissions << permission - end - else - ok = false - end - else - ok = false - end + @permissions = [] + ret = Scr.instance.execute(["polkit-action"]) + return false unless ret && ret[:exit] == 0 + + suse_string = "org.opensuse.yast." + lines = ret[:stdout].split("\n") rescue [] + + # a hash for mapping string 'permission name' => boolean 'granted' + perms = Hash.new + + lines.each do |s| + if (s.include?( suse_string )) && + (filter.blank? || s.include?( filter )) + # set 'not granted' default + perms[s] = false + end + end + + ret = Scr.instance.execute(["polkit-auth", "--user", user_id, "--explicit"]) + return false unless ret && ret[:exit] == 0 + + lines = ret[:stdout].split("\n") rescue [] + lines.each do |s| + # ignore the rights which do not have the prefix, do not have any .policy file + # or do not match the filter + if (s.include?( suse_string )) && perms.has_key?(s) && (filter.blank? || s.include?( filter )) + # update the value to 'granted' state + perms[s] = true + end + end + + # convert the hash to a list of Permission objects + @permissions = [] + perms.each do |name,value| + permission = Permission.new + permission.name = name + permission.grant = value + @permissions << permission + end end + + public #-------------------------------------------------------------------------------- # # actions @@ -76,14 +72,12 @@ class PermissionsController < ApplicationController if params[:user_id].blank? render ErrorResult.error(404, 2, "user_id is not defined") and return end - if !get_permission_list(params[:user_id], params[:filter]) + unless get_permission_list(params[:user_id], params[:filter]) render ErrorResult.error(404, 2, "cannot get permission list") and return end end # GET /users/<uid>/permissions/<id>?user_id= - # GET /users/<uid>/permissions/<id>.xml?user_id= - # GET /users/<uid>/permissions/<id>.json?user_id= def show unless (permission_check( "org.opensuse.yast.permissions.read") || (!params[:user_id].blank? && self.current_account.login == params[:user_id])) @@ -95,16 +89,9 @@ class PermissionsController < ApplicationController if params[:id].blank? render ErrorResult.error(404, 2, "right is not defined") and return end - jsonFormat = false right = params[:id] - if params[:id].end_with?(".json") - jsonFormat = true - right = params[:id].slice(0..-7) - else - right = params[:id].slice(0..-5) if params[:id].end_with?(".xml") - end @permission = Permission.new - if !get_permission_list(params[:user_id]) + unless get_permission_list(params[:user_id]) render ErrorResult.error(404, 1, "cannot get permission list") and return end for i in 0..@permissions.size-1 @@ -113,12 +100,14 @@ class PermissionsController < ApplicationController break end end - if permission.name.blank? + if !permission || permission.name.blank? render ErrorResult.error(404, 1, "Permission: #{right} not found.") and return end - return render(:json => permission.to_json, :location => "none") if jsonFormat - return render(:xml => permission, :location => "none") + respond_to do |format| + format.json { render(:json => permission.to_json, :location => "none") } + format.xml { render(:xml => permission, :location => "none") } + end end # PUT /permissions/ diff --git a/webservice/test/functional/permissions_controller_test.rb b/webservice/test/functional/permissions_controller_test.rb index 4e754e8..58de311 100644 --- a/webservice/test/functional/permissions_controller_test.rb +++ b/webservice/test/functional/permissions_controller_test.rb @@ -12,84 +12,117 @@ require 'mocha' class PermissionsControllerTest < ActionController::TestCase fixtures :accounts + def setup @controller = PermissionsController.new @request = ActionController::TestRequest.new + + # Fake an active session # http://railsforum.com/viewtopic.php?id=1719 @request.session[:account_id] = 1 # defined in fixtures + Scr.any_instance.stubs(:execute).with(["polkit-action"]).returns({:stderr=>"", :exit=>0, :stdout=>"org.opensuse.yast.system.users.read\norg.opensuse.yast.system.users.write\norg.opensuse.yast.system.users.new\norg.opensuse.yast.system.users.delete\n"}) - Scr.any_instance.stubs(:execute).with(["polkit-auth", "--user", "schubi", "--explicit"]).returns(:stderr=>"", :exit=>0, :stdout=>"org.opensuse.yast.system.users.read\norg.opensuse.yast.system.users.write\norg.opensuse.yast.system.users.new\n") - Scr.any_instance.stubs(:execute).with(['polkit-auth', '--user', 'schubi', '--grant', 'org.opensuse.yast.patch.install']).returns({:stderr=>"", :exit=>0, :stdout=>""}) + Scr.any_instance.stubs(:execute).with(["polkit-auth", "--user", "test_user", "--explicit"]).returns(:stderr=>"", :exit=>0, :stdout=>"org.opensuse.yast.system.users.read\norg.opensuse.yast.system.users.write\norg.opensuse.yast.system.users.new\n") + Scr.any_instance.stubs(:execute).with(['polkit-auth', '--user', 'test_user', '--grant', 'org.opensuse.yast.patch.install']).returns({:stderr=>"", :exit=>0, :stdout=>""}) end - test "access index" do - get :index, :user_id => "schubi" + test "permissions access index" do + get :index, :user_id => "test_user" assert_response :success end - test "access index xml" do + test "permissions access index production" do + save = ENV['RAILS_ENV'] + ENV['RAILS_ENV'] = "production" + get :index + ENV['RAILS_ENV'] = save + assert_response 403 + end + + test "permissions access index xml" do mime = Mime::XML @request.accept = mime.to_s - get :index, :user_id => "schubi", :format => :xml + get :index, :user_id => "test_user", :format => :xml assert_equal mime.to_s, @response.content_type end - test "access index json" do + test "permissions access index json" do mime = Mime::JSON @request.accept = mime.to_s - get :index, :user_id => "schubi", :format => :json + get :index, :user_id => "test_user", :format => :json assert_equal mime.to_s, @response.content_type end - test "access index without user" do + test "permissions access index without user" do get :index assert_response 404 end - test "access index with wrong user" do + test "permissions access index with wrong user" do Scr.any_instance.stubs(:execute).with(["polkit-auth", "--user", "not avail", "--explicit"]).returns({:stderr=>"polkit-auth: cannot look up uid for user 'not avail'\n", :exit=>1, :stdout=>""}) get :index, :user_id => "not avail" assert_response 404 end - test "access show" do - get :show, :id => "org.opensuse.yast.system.users.read", :user_id => "schubi" + test "permissions access show" do + get :show, :id => "org.opensuse.yast.system.users.read", :user_id => "test_user" assert_response :success end - test "access show without right" do - get :show, :user_id => "schubi" - assert_response 404 + test "permissions access show json" do + mime = Mime::JSON + @request.accept = mime.to_s + get :show, :id => "org.opensuse.yast.system.users.read", :user_id => "test_user" + assert_response :success end - test "access show without user" do + test "permissions access show production" do + save = ENV['RAILS_ENV'] + ENV['RAILS_ENV'] = "production" + get :show, :id => "org.opensuse.yast.system.users.read" + ENV['RAILS_ENV'] = save + assert_response 403 + end + + test "permissions access show without right" do + save = ENV['RAILS_ENV'] + ENV['RAILS_ENV'] = "production" + get :show, :user_id => "nobody" + ENV['RAILS_ENV'] = save + assert_response 403 + end + + test "permissions access show without user" do get :show, :id => "org.opensuse.yast.system.users.read" assert_response 404 end - test "access show without user AND right" do + test "permissions access show without user AND right" do get :show assert_response 404 end - test "setting permissions" do - put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"schubi", "grant"=>true}, :id=>"schubi.xml" + test "permissions setting" do + put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"test_user", "grant"=>true}, :id=>"test_user" assert_response :success end - test "setting permissions without permissions" do - put :update, :id=>"schubi.xml" - assert_response 404 + test " setting permissions without permissions" do + save = ENV['RAILS_ENV'] + ENV['RAILS_ENV'] = "production" + put :update, :id=>"nobody" + ENV['RAILS_ENV'] = save + assert_response 403 end test "setting permissions without user" do - put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"schubi", "grant"=>true} + put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"test_user", "grant"=>true} assert_response 404 end test "setting permissions returns false from polkit-auth" do - Scr.any_instance.stubs(:execute).with(['polkit-auth', '--user', 'schubi', '--grant', 'org.opensuse.yast.patch.install']).returns({:stderr=>"error", :exit=>1, :stdout=>""}) - put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"schubi", "grant"=>true}, :id=>"schubi.xml" + Scr.any_instance.stubs(:execute).with(['polkit-auth', '--user', 'test_user', '--grant', 'org.opensuse.yast.patch.install']).returns({:stderr=>"error", :exit=>1, :stdout=>""}) + put :update, :permissions => {"name"=>"org.opensuse.yast.patch.install", "id"=>"test_user", "grant"=>true}, :id=>"test_user" assert_response 404 end -- To unsubscribe, e-mail: yast-commit+unsubscribe@opensuse.org For additional commands, e-mail: yast-commit+help@opensuse.org