6:20 p.m.
Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com>
---
src/wok/control/base.py | 13 +++++++----
src/wok/control/config.py | 6 ++---
tests/test_authorization.py | 57 +++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 69 insertions(+), 7 deletions(-)
create mode 100644 tests/test_authorization.py
diff --git a/src/wok/control/base.py b/src/wok/control/base.py
index 3070e53..0791062 100644
--- a/src/wok/control/base.py
+++ b/src/wok/control/base.py
@@ -27,7 +27,7 @@ import urllib2
import wok.template
from wok.asynctask import save_request_log_id
-from wok.auth import USER_GROUPS, USER_NAME, USER_ROLE
+from wok.auth import wokauth, USER_GROUPS, USER_NAME, USER_ROLE
from wok.control.utils import get_class_name, internal_redirect, model_fn
from wok.control.utils import parse_request, validate_method
from wok.control.utils import validate_params
@@ -91,7 +91,7 @@ class Resource(object):
raise cherrypy.HTTPRedirect(base_uri % tuple(uri_params), code)
def generate_action_handler(self, action_name, action_args=None,
- destructive=False):
+ destructive=False, protected=None):
def _render_element(self, ident):
self._redirect(ident)
uri_params = []
@@ -104,7 +104,8 @@ class Resource(object):
return self._generate_action_handler_base(action_name, _render_element,
destructive=destructive,
- action_args=action_args)
+ action_args=action_args,
+ protected=protected)
def generate_action_handler_task(self, action_name, action_args=None):
def _render_task(self, task):
@@ -115,10 +116,14 @@ class Resource(object):
action_args=action_args)
def _generate_action_handler_base(self, action_name, render_fn,
- destructive=False, action_args=None):
+ destructive=False, action_args=None,
+ protected=None):
def wrapper(*args, **kwargs):
# status must be always set in order to request be logged.
# use 500 as fallback for "exception not handled" cases.
+ if protected is not None and protected:
+ wokauth()
+
details = None
status = 500
diff --git a/src/wok/control/config.py b/src/wok/control/config.py
index 8da2fc0..a18fff0 100644
--- a/src/wok/control/config.py
+++ b/src/wok/control/config.py
@@ -44,7 +44,7 @@ class Config(Resource):
self.admin_methods = ['POST']
self.plugins = Plugins(self.model)
self.log_map = CONFIG_REQUESTS
- self.reload = self.generate_action_handler('reload')
+ self.reload = self.generate_action_handler('reload', protected=True)
@property
def data(self):
@@ -64,8 +64,8 @@ class Plugin(Resource):
self.admin_methods = ['POST']
self.uri_fmt = "/config/plugins/%s"
self.log_map = PLUGIN_REQUESTS
- self.enable = self.generate_action_handler('enable')
- self.disable = self.generate_action_handler('disable')
+ self.enable = self.generate_action_handler('enable', protected=True)
+ self.disable = self.generate_action_handler('disable', protected=True)
@property
def data(self):
diff --git a/tests/test_authorization.py b/tests/test_authorization.py
new file mode 100644
index 0000000..7b7bbcc
--- /dev/null
+++ b/tests/test_authorization.py
@@ -0,0 +1,57 @@
+#
+# Project Wok
+#
+# Copyright IBM Corp, 2014-2017
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+import unittest
+from functools import partial
+
+from tests.utils import patch_auth
+from tests.utils import request, run_server
+
+test_server = None
+
+
+def setUpModule():
+ global test_server
+
+ patch_auth()
+ test_server = run_server(test_mode=True)
+
+
+def tearDownModule():
+ test_server.stop()
+
+
+class AuthorizationTests(unittest.TestCase):
+ def setUp(self):
+ self.request = partial(request, user='user')
+
+ def test_nonroot_access(self):
+ # Non-root users can not reload wok config
+ resp = self.request('/config', '{}', 'GET')
+ self.assertEquals(200, resp.status)
+ resp = self.request('/config/reload', '{}', 'POST')
+ self.assertEquals(403, resp.status)
+
+ # Non-root users can not enable/disable a plugin
+ resp = self.request('/config/plugins/sample', '{}',
'GET')
+ self.assertEquals(200, resp.status)
+ resp = self.request('/config/plugins/sample/enable', '{}',
'POST')
+ self.assertEquals(403, resp.status)
+ resp = self.request('/config/plugins/sample/disable', '{}',
'POST')
+ self.assertEquals(403, resp.status)
--
2.9.3