# HG changeset patch # User Marcus Granado <[email protected]> # Date 1265040437 0 # Node ID b3c4de44c72e5a85d70e3b94178fa8c83ed2db33 # Parent 7ed4bfa16208f5574246fa4bcf486bc53332fe54 CA-36252: non-RBAC errors in xapi_http should pass through
Signed-off-by: Marcus Granado <[email protected]> diff -r 7ed4bfa16208 -r b3c4de44c72e ocaml/xapi/xapi_http.ml --- a/ocaml/xapi/xapi_http.ml Mon Feb 01 14:09:52 2010 +0000 +++ b/ocaml/xapi/xapi_http.ml Mon Feb 01 16:07:17 2010 +0000 @@ -89,7 +89,7 @@ then Some (Ref.of_string (List.assoc "task_id" all)) else None in - let rbac_raise permission msg = + let rbac_raise permission msg exc = (match task_id with | None -> () | Some task_id -> @@ -97,7 +97,7 @@ ~__context:(Context.from_forwarded_task task_id) (Api_errors.rbac_permission_denied,[permission;msg]) ); - raise (Http.Forbidden) + raise exc in let rbac_task_desc = "handler" in let rbac_check session_id = @@ -107,8 +107,8 @@ with | Api_errors.Server_error (err,[perm;msg]) when err = Api_errors.rbac_permission_denied - -> rbac_raise perm msg - | e -> rbac_raise http_permission (ExnHelper.string_of_exn e) + -> rbac_raise perm msg Http.Forbidden + | e -> rbac_raise http_permission (ExnHelper.string_of_exn e) e ) in if List.mem_assoc "session_id" all @@ -228,15 +228,16 @@ | Http_svr.BufIO callback -> Http_svr.BufIO (fun req ic -> (try - (try if check_rbac then (* rbac checks *) + (try assert_credentials_ok name req ~fn:(fun () -> callback req ic) + with e -> + debug "Leaving RBAC-handler in xapi_http after: %s" (ExnHelper.string_of_exn e); + raise e + ) else (* no rbac checks *) callback req ic - with e -> - error "RBAC: %s" (ExnHelper.string_of_exn e); - raise e) with | Api_errors.Server_error(name, params) as e -> error "Unhandled Api_errors.Server_error(%s, [ %s ])" name (String.concat "; " params); 1 file changed, 9 insertions(+), 8 deletions(-) ocaml/xapi/xapi_http.ml | 17 +++++++++--------
# HG changeset patch # User Marcus Granado <[email protected]> # Date 1265040437 0 # Node ID b3c4de44c72e5a85d70e3b94178fa8c83ed2db33 # Parent 7ed4bfa16208f5574246fa4bcf486bc53332fe54 CA-36252: non-RBAC errors in xapi_http should pass through Signed-off-by: Marcus Granado <[email protected]> diff -r 7ed4bfa16208 -r b3c4de44c72e ocaml/xapi/xapi_http.ml --- a/ocaml/xapi/xapi_http.ml Mon Feb 01 14:09:52 2010 +0000 +++ b/ocaml/xapi/xapi_http.ml Mon Feb 01 16:07:17 2010 +0000 @@ -89,7 +89,7 @@ then Some (Ref.of_string (List.assoc "task_id" all)) else None in - let rbac_raise permission msg = + let rbac_raise permission msg exc = (match task_id with | None -> () | Some task_id -> @@ -97,7 +97,7 @@ ~__context:(Context.from_forwarded_task task_id) (Api_errors.rbac_permission_denied,[permission;msg]) ); - raise (Http.Forbidden) + raise exc in let rbac_task_desc = "handler" in let rbac_check session_id = @@ -107,8 +107,8 @@ with | Api_errors.Server_error (err,[perm;msg]) when err = Api_errors.rbac_permission_denied - -> rbac_raise perm msg - | e -> rbac_raise http_permission (ExnHelper.string_of_exn e) + -> rbac_raise perm msg Http.Forbidden + | e -> rbac_raise http_permission (ExnHelper.string_of_exn e) e ) in if List.mem_assoc "session_id" all @@ -228,15 +228,16 @@ | Http_svr.BufIO callback -> Http_svr.BufIO (fun req ic -> (try - (try if check_rbac then (* rbac checks *) + (try assert_credentials_ok name req ~fn:(fun () -> callback req ic) + with e -> + debug "Leaving RBAC-handler in xapi_http after: %s" (ExnHelper.string_of_exn e); + raise e + ) else (* no rbac checks *) callback req ic - with e -> - error "RBAC: %s" (ExnHelper.string_of_exn e); - raise e) with | Api_errors.Server_error(name, params) as e -> error "Unhandled Api_errors.Server_error(%s, [ %s ])" name (String.concat "; " params);
_______________________________________________ xen-api mailing list [email protected] http://lists.xensource.com/mailman/listinfo/xen-api
