[CLOUDSTACK-5145] ListNetworkACL API should list ACLs owned by the user only

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 4.2.1, 4.3.0
• Security Level: Public (Anyone can view this level - this is the default.)
• Assignee: Kishan
• Reporter: Kishan
• Created: 12/Nov/13 10:57
• Updated: 24/Jan/14 17:39
• Resolved: 09/Dec/13 16:31

Description

ListNetworkACL API should filter ACLs by caller and list ACLs which can be accessed by the user only.

If API call is not called with a networkid or other filter, every ACL in the system is dumped, which is both a performance issue and a security issue. If a networkid is provided, but the network doesn't have an ACL list or any ACL items attached, the same issue occurs.

Likewise, listNetworkACLLists gives access to see non-owned lists, which in turn gives vpc ids for non-owned resources.

Example:

1. Set up a zone
2. Create a VPC or network as admin
3. Create an ACL list for the network
4. Create a new domain and unprivileged user
5. Generate API keys for user
6. Issue a 'listNetworkACLs' API call. You should see the ACL list items from the admin-owned list
7. Issue a 'listNetworkACLLists' API call referencing aclid from non-owned acl item. You should see the acl list info and which vpc it belongs to.
8. Listing the vpc attached to the acl list properly stops with an 'unauthorized' response as step 7 above should.

Issue Links

• is duplicated by: CLOUDSTACK-5944 listNetworkACLs unexpectedly returns all ACL's