From 34356e73b92655af78034d4b6e3eff438b437ec1 Mon Sep 17 00:00:00 2001
From: hulina <hulina@cmss.chinamobile.com>
Date: Tue, 20 Nov 2018 19:34:07 +0800
Subject: [PATCH] Check all_tenants value in share_networks api

Add manila.utils.is_all_tenants to check all_tenants value.

Closes-Bug: #1777551
Change-Id: I1b66a25169cdd23a76bf76c799d04521fdf5f8e9
---
 manila/api/v2/share_networks.py               |  3 ++-
 manila/tests/api/v2/test_share_networks.py    | 27 +++++++++++++++++++
 ...-api-all-tenants-fix-a061274afe15180d.yaml |  8 ++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml

diff --git a/manila/api/v2/share_networks.py b/manila/api/v2/share_networks.py
index be97ccd8bc..d3deb31412 100644
--- a/manila/api/v2/share_networks.py
+++ b/manila/api/v2/share_networks.py
@@ -33,6 +33,7 @@ from manila.i18n import _
 from manila import policy
 from manila import quota
 from manila.share import rpcapi as share_rpcapi
+from manila import utils
 
 RESOURCE_NAME = 'share_network'
 RESOURCES_NAME = 'share_networks'
@@ -119,7 +120,7 @@ class ShareNetworkController(wsgi.Controller):
         elif context.is_admin and 'project_id' in search_opts:
             networks = db_api.share_network_get_all_by_project(
                 context, search_opts['project_id'])
-        elif context.is_admin and 'all_tenants' in search_opts:
+        elif context.is_admin and utils.is_all_tenants(search_opts):
             networks = db_api.share_network_get_all(context)
         else:
             networks = db_api.share_network_get_all_by_project(
diff --git a/manila/tests/api/v2/test_share_networks.py b/manila/tests/api/v2/test_share_networks.py
index a08546a408..5651bd91f6 100644
--- a/manila/tests/api/v2/test_share_networks.py
+++ b/manila/tests/api/v2/test_share_networks.py
@@ -408,6 +408,33 @@ class ShareNetworkAPITest(test.TestCase):
             result[share_networks.RESOURCES_NAME][0],
             fake_share_network_shortened)
 
+    @mock.patch.object(db_api, 'share_network_get_all', mock.Mock())
+    def test_index_all_tenants_with_invaild_value(self):
+        req = fakes.HTTPRequest.blank(
+            '/share_networks?all_tenants=wonk',
+            use_admin_context=True)
+
+        self.assertRaises(exception.InvalidInput, self.controller.index, req)
+
+    @mock.patch.object(db_api, 'share_network_get_all_by_project', mock.Mock())
+    @mock.patch.object(db_api, 'share_network_get_all', mock.Mock())
+    def test_index_all_tenants_with_value_zero(self):
+        db_api.share_network_get_all_by_project.return_value = [
+            fake_share_network]
+        req = fakes.HTTPRequest.blank(
+            '/share_networks?all_tenants=0',
+            use_admin_context=True)
+
+        result = self.controller.index(req)
+
+        self.assertEqual(1, len(result[share_networks.RESOURCES_NAME]))
+        self._check_share_network_view_shortened(
+            result[share_networks.RESOURCES_NAME][0],
+            fake_share_network_shortened)
+        db_api.share_network_get_all_by_project.assert_called_once_with(
+            req.environ['manila.context'], self.context.project_id)
+        db_api.share_network_get_all.assert_not_called()
+
     @mock.patch.object(db_api, 'share_network_get_all_by_project', mock.Mock())
     def test_index_filter_by_project_id_non_admin_context(self):
         req = fakes.HTTPRequest.blank(
diff --git a/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml b/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml
new file mode 100644
index 0000000000..455df0b79a
--- /dev/null
+++ b/releasenotes/notes/bug-1777551-security-networks-api-all-tenants-fix-a061274afe15180d.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    The ``all_tenants`` query parameter in the share networks API (GET
+    /v2/{project_id}/share-networks) has been fixed to accept 'f',
+    'false', 'off', 'n', 'no', or '0'. Setting the flag to any of these values
+    will retrieve security services only from the requester's project
+    namespace.