admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2257 from wanjunlei/auditing-authority

Browse Source 
add resourcescope to AttributesRecord when determine whether the user…
This commit is contained in:
KubeSphere CI Bot
2020-06-27 20:45:42 +08:00
committed by GitHub
parent eb1001d2b8 0e6277ed66
commit 2a05365871
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/models/tenant/tenant.go
View File

@@ -707,15 +707,14 @@ func (t *tenantOperator) Auditing(user user.Info, queryParam *auditingv1alpha1.Q
// those events with empty `ObjectRef.Namespace` will also be listed when user can list all namespaces // those events with empty `ObjectRef.Namespace` will also be listed when user can list all namespaces
if len(queryParam.WorkspaceFilter) == 0 && len(queryParam.ObjectRefNamespaceFilter) == 0 && if len(queryParam.WorkspaceFilter) == 0 && len(queryParam.ObjectRefNamespaceFilter) == 0 &&
len(queryParam.WorkspaceSearch) == 0 && len(queryParam.ObjectRefNamespaceSearch) == 0 { len(queryParam.WorkspaceSearch) == 0 && len(queryParam.ObjectRefNamespaceSearch) == 0 {
listEvts := authorizer.AttributesRecord{ listNs := authorizer.AttributesRecord{
User: user, User: user,
Verb: "list", Verb: "list",
APIGroup: "",
APIVersion: "v1",
Resource: "namespaces", Resource: "namespaces",
ResourceRequest: true, ResourceRequest: true,
ResourceScope: request.ClusterScope,
} }
decision, _, err := t.authorizer.Authorize(listEvts) decision, _, err := t.authorizer.Authorize(listNs)
if err != nil { if err != nil {
klog.Error(err) klog.Error(err)
return nil, err return nil, err