openstack/designate
Code Issues Proposed changes

Fix set-quotas for non-project scoped tokens

Browse Source 
Previously, if set-quotas was called with a non-project scoped token and the all-projects flag was not set, the quotas would be updated but the result returned
would always be the default quota values.
This patch changes the API to require the all-projects flag when set-quota is called and the token is not project scoped.

Closes-Bug: #1966128
Change-Id: I55ca76ef7c2cbeb5fdae1aed1dcbe58b7acddc34
This commit is contained in:
Michael Johnson 2022-03-23 20:52:35 +00:00
parent c998ff6900
commit 158e017be4
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
designate/api/v2/controllers/quotas.py
View File

@ -19,6 +19,7 @@ import pecan
from designate.api.v2.controllers import rest
from designate.common import keystone
from designate import exceptions
from designate.objects.adapters import DesignateAdapter
from designate.objects import QuotaList
@ -63,6 +64,15 @@ class QuotasController(rest.RestController):
quotas = DesignateAdapter.parse('API_v2', body, QuotaList())
# The get_quotas lookup will always return the default quotas
# if the context does not have a project_id (system scoped token) and
# the all_tenants boolean is false. Let's require all_tenants for
# contexts with no project ID.
if context.project_id is None and not context.all_tenants:
raise exceptions.MissingProjectID(
"The all-projects flag must be used when using non-project "
"scoped tokens.")
for quota in quotas:
self.central_api.set_quota(context, tenant_id, quota.resource,
quota.hard_limit)

6
releasenotes/notes/Require-all-projects-for-set-quotas-with-non-project-scoped-tokens-ffe3082db3dbb55b.yaml Normal file
View File

@ -0,0 +1,6 @@
---
fixes:
- |
Fixed an issue where set-quotas will always return the default quotas if
it was called with a non-project scoped token and the all-projects flag
was not set.