Skip to content

Test/test encore branch #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jschoewe wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Test/test encore branch #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
63fa4f9
Moved permission checks into if statement because we dont need to run…
jschoewe Mar 14, 2023
b8948d7
Added CHANGLOG message
jschoewe Mar 14, 2023
2f6a87f
Test commit for running unit tests
jschoewe Mar 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ in development

Added
~~~~~

* Fix KV value lookup in actions when RBAC is enabled #5934

* Move `git clone` to `user_home/.st2packs` #5845

* Error on `st2ctl status` when running in Kubernetes. #5851
Expand Down
22 changes: 11 additions & 11 deletions st2common/st2common/services/keyvalues.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,17 +191,17 @@ def _get_kv(self, key):
if kvp:
LOG.debug("Got value %s from datastore.", kvp.value)

# Check that user has permission to the key value pair.
# If RBAC is enabled, this check will verify if user has system role with all access.
# If RBAC is enabled, this check guards against a user accessing another user's kvp.
# If RBAC is enabled, user needs to be explicitly granted permission to view a system kvp.
# The check is sufficient to allow decryption of the system kvp.
rbac_utils = get_rbac_backend().get_utils_class()
rbac_utils.assert_user_has_resource_db_permission(
user_db=UserDB(name=self._user),
resource_db=kvp,
permission_type=PermissionType.KEY_VALUE_PAIR_VIEW,
)
# Check that user has permission to the key value pair.
# If RBAC is enabled, this check will verify if user has system role with all access.
# If RBAC is enabled, this check guards against a user accessing another user's kvp.
# If RBAC is enabled, user needs to be explicitly granted permission to view a system kvp.
# The check is sufficient to allow decryption of the system kvp.
rbac_utils = get_rbac_backend().get_utils_class()
rbac_utils.assert_user_has_resource_db_permission(
user_db=UserDB(name=self._user),
resource_db=kvp,
permission_type=PermissionType.KEY_VALUE_PAIR_VIEW,
)

return kvp.value if kvp else ""

Expand Down