From 77fd76acb47fd56ff0c265c6b15b4497a57e40c7 Mon Sep 17 00:00:00 2001 From: Alena Prokharchyk Date: Thu, 27 Jun 2013 11:31:21 -0700 Subject: [PATCH] CLOUDSTACK-3242: fixed updateTemplate and updateTemplate permissions security checks for project based templates --- server/src/com/cloud/acl/DomainChecker.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/server/src/com/cloud/acl/DomainChecker.java b/server/src/com/cloud/acl/DomainChecker.java index c778c501b82..8b20f3def5b 100755 --- a/server/src/com/cloud/acl/DomainChecker.java +++ b/server/src/com/cloud/acl/DomainChecker.java @@ -19,11 +19,11 @@ package com.cloud.acl; import javax.ejb.Local; import javax.inject.Inject; -import org.springframework.stereotype.Component; - import org.apache.cloudstack.acl.ControlledEntity; import org.apache.cloudstack.acl.SecurityChecker; import org.apache.cloudstack.api.BaseCmd; +import org.springframework.stereotype.Component; + import com.cloud.dc.DataCenter; import com.cloud.domain.Domain; import com.cloud.domain.dao.DomainDao; @@ -95,6 +95,10 @@ public class DomainChecker extends AdapterBase implements SecurityChecker { if (BaseCmd.isRootAdmin(caller.getType()) || (owner.getId() == caller.getId())) { return true; } + //special handling for the project case + if (owner.getType() == Account.ACCOUNT_TYPE_PROJECT && _projectMgr.canAccessProjectAccount(caller, owner.getId())) { + return true; + } // since the current account is not the owner of the template, check the launch permissions table to see if the // account can launch a VM from this template