yahoo-eng-team team mailing list archive

[Launchpad Bug Tracker <1352907@xxxxxxxxxxxxxxxxxx>]

You have been subscribed to a public bug:

I used a normal user to create a network successfully,then I wanted to update the "shared" property of the network.
It failed,and response 404 erorr,the message is :The resource could not be found.But I have created the network,it is so strange.

I check the policy.json of neutron, the rule is: "update_network:shared": "rule:admin_only", so the normal user can't update it.
So the error information is wrong.

Check the code:
    def update(self, request, id, body=None, **kwargs):
        """Updates the specified entity's attributes."""
      ......
      ......
        try:
            policy.enforce(request.context,
                           action,
                           orig_obj)
        except exceptions.PolicyNotAuthorized:
            # To avoid giving away information, pretend that it
            # doesn't exist
            msg = _('The resource could not be found.')
            raise webob.exc.HTTPNotFound(msg)

I think we couldn't provide the wrong response information to avoid
giving away information,and there isn't any information that need to
avoid giving away here, So I think it is a bug.

I suggest to modify the code like this:
       try:
            policy.enforce(request.context,
                           action,
                           orig_obj)
        except exceptions.PolicyNotAuthorized:
            # To avoid giving away information, pretend that it
            # doesn't exist
            # msg = _('The resource could not be found.')
			
            raise webob.exc.HTTPForbidden(exceptions.PolicyNotAuthorized.message)

** Affects: neutron
     Importance: Undecided
         Status: New

-- 
response of normal user update the "shared" property of network 
https://bugs.launchpad.net/bugs/1352907
You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron.