-
Notifications
You must be signed in to change notification settings - Fork 27
Hardening_conductor_entry_points
Hardening home page - Hardening_the_app
api controller namespace ‘’’not’‘’ analyzed as it is being removed
|.Controller|.Method|.Authenticates User|.Authorizes User +
Data|.Validates Data|.Securely invokes functionality|_.Other|
| | | | | | |
|user_sessions|new|no|||yes||
|user_sessions|create|no||uses :login, :password params to login|?|uses
regex global variable when doing http basic auth validation|
|user_sessions|edit|||||method does not exist|
|user_sessions|show|||||method does not exist|
|user_sessions|update|||||method does not exist|
|user_sessions|destroy|yes|||yes||
|users|new|n/a|Privilege::CREATE on User class if user is logged
in|n/a|yes|
|users|create|n/a|Privilege::MODIFY on User class if user is logged
in|params[:commit] tested against static string, params[:user] used to
create new User instance|yes|Quota may be set twice, is this correct
(?);|
|users|edit|yes|Privilege::MODIFY on User class unless user being edited
is current user|looks up user by ’id’ parameter|yes|
|users|show|yes|Privilege::VIEW on User class unless user being viewed
is current user|looks up user by ‘id’ parameter, uses ‘details_tab’,
‘details_pane’ to determine which view is rendered, |yes||
|users|update|yes|Privilege::MODIFY on User class unless user being
updated is current user|looks up user by ‘id’ param, updates user
instance w/ ‘user’ param, tests ‘commit’ param against static ‘Reset’
string to control workflow|yes||
|users|destroy|yes|Privilege::MODIFY on User class|looks up user by ‘id’
param|yes|
|users|multi_destroy|yes|Privilege::MODIFY on User class|looks up users
by ‘user_selected’ param|yes|
|users|filter|no (change?)|no|uses :current_path,
:users_preset_filter, and :users_search params to construct
redirect_to location|yes|
|users|index|yes|Privilege::VIEW on User class|makes ‘params’ array
available to views (good idea?); uses :users_preset_filter,
:users_search params to filter users, :sort_by to sort users |yes|
(method needs to be optimized)|
|permissions|load_headers|n/a|n/a|uses :sort_by parameter to specify
‘order’ to db users query|yes||
|permissions|set_permission_object|n/a|Privilege::PERM_SET on db
entity specified by
:permission_object_type,:permission_object_id|uses
:permission_object_type,:permission_object_id params to lookup db
entity; :path_prefix, :use_tabs, :polymorphic_path_extras params to
construct url path|yes||
|permissions|index|yes|Privilege::PERM_VIEW on db entity specified by
:permission_object_type,:permission_object_id|see
permissions::set_permission_object and
permissions::load_headers|yes|
|permissions|list|yes||||
|permissions|multi_destroy|yes|Privilege::PERM_SET on db entity
specified by :permission_object_type,:permission_object_id and
Privilege::PERM_SET on permission_objects of permissions specified
:permission_selected|see permissions::set_permission_object; uses
:permission_selected param to find Permission entities to delete|yes|
|permissions|multi_update|yes|Privilege::PERM_SET on db entity
specified by :permission_object_type,:permission_object_id|see
permissions::set_permission_object; uses:user_role_selected
parameter for user_id/role_id inputs to new Permission entity|yes|
|permissions|filter|yes|||yes||
|permissions|create|yes|Privilege::PERM_SET on db entity specified by
:permission_object_type,:permission_object_id|see
permissions::set_permission_object; uses:user_role_selected
parameter for user_id/role_id inputs to new Permission entity|yes|
|permissions|new|yes|Privilege::PERM_SET on db entity specified by
:permission_object_type,:permission_object_id|see
permissions::set_permission_object and
permissions::load_headers|yes|
|permissions|edit|||||method does not exist|
|permissions|show|yes||||method does not exist|
|permissions|update|yes||||method does not exist|
|permissions|destroy|yes|Privilege::PERM_SET on db entity specified by
:permission[:id]|uses :permission[:id] to find permission to
destroy|yes||
|settings|self_service|yes|Privilege::MODIFY|n/a|yes||
|settings|general_settings|yes|Privilege::MODIFY|n/a|yes||
|settings|index|yes|no|n/a|yes||
|settings|create|||||method does not exist|
|settings|new|||||method does not exist|
|settings|edit|||||method does not exist|
|settings|show|||||method does not exist|
|settings|update|yes|no|if params[self_service_default_quota] is set,
it is used to update_attributes of the
self_service_default_quota_metadata object|no|this method should be
locked down + simplified (especially given the KEYS array) or removed
alltogether|
|settings|destroy|||||method does not exist|
|pools|hardware_profiles|||||method does not exist, route should be
removed|
|pools|realms|||||method does not exist, route should be removed|
|pools|multi_destroy|yes|Privilege::MODIFY on pools specified by
params[:pools_selected]|params[:pools_selected] used as an array of
ids to find|yes||
|pools|filter|no (change?)|no|uses:pools_preset_filter and
:pools_search params to construct redirect_to location|yes||
|pools|index|yes|retrieves list of pools for current user for which they
have Privilege::Create on deployments|used :details_tab, :only_tab,
:view params to construct view components; uses :pools_preset_filter,
:pools_search, :instances_preset_filter, :instances_search,
:deployments_preset_filter,:deployments_search to apply_filters to
Pools, Instances, Deployments|yes||
|pools|create|yes|Privilege::CREATE on Pool|uses params[:pool] to create
a new pool|yes||
|pools|new|yes|Privilege::CREATE on Pool|uses params[:pool_family_id]
to lookup pool|yes|should there be an additional privilege check for the
pool family?|
|pools|edit|yes|Privilege::MODIFY on the pool specified by
params[:id]|uses params[:id] to find pool|yes||
|pools|show|yes|Privilege::VIEW on the pools specified by
params[:id]|uses :details_tab, to format view components, uses
:deployments_preset_filter, :deployments_search to apply_filters to
pool deployments|yes||
|pools|update|yes|Privilege::MODIFY on the pool specified by
params[:id]|uses params[:id] to find pool; uses params[:pool] to update
pool; uses params[:quota] and :unlimited_quota to set
max_running_instances of pool’s quota|yes||
|pools|destroy|yes|Privilege::MODIFY on the pool(s) specified by
:pools_selected/:id/:ids params|uses :pools_selected/:id/:ids params
to find pools to destroy|yes||
|deployments|multi_stop|yes|retrieves pools which the current_user has
Privilege::Create on deployments, requires Privilege::Use of
deployments’ instances|uses :deployments_selected to find deployments,
uses :deployments_preset_filter, :deployments_search params to
apply_filters to Deployment, and :page param to paginate Deployments
|yes|can functionality can be delegated to a lower method?|
|deployments|multi_destroy|y|requires Privilege::Modify on deployments
specified by :deployments_selected, retrieves pools which the
current_user has Privilege::Create on deployments|uses
:deployments_selected param to find deployment, uses :backlink param as
redirect path, uses :deployments_preset_filter, :deployments_search
params to apply_filters to Deployment, and :page param to paginate
Deployments|yes| |
|deployments|launch_new|y|requires Privilege::Create on deployments in
the pool specified by the :pool_id param|uses :pool_id param to find
Pool|yes| |
|deployments|launch_time_params|y|requires Privileges::Create on
deployments in the pool corresponding to that specified in the
:deployment param|:deployable_id param is used to find the deployable,
:deployment param is used to construct a new deployment|yes| |
|deployments|overview|y|requires Privileges::Create on deployments in
the pool corresponding to that specified in the :deployment param,
retrieves deployables which the current_user has Privilege::USE on,
retrieves pools which the current_user has Privilege::Create on
deployments|:deployable_id param is used to find the deployable,
:deployment param is used to construct a new deployment|yes|Does not
enforce permission checks on deployable found by deployable_id or
realms/hardwareprofiles retrieved (change?)|
|deployments|check_name|y|n|uses :name param to find deployable by
name, returns true/false|yes|remove race condition comment|
|deployments|launch_from_catalog|y|requires Privilege::View on catalog
specified by catalog_id|uses :catalog_id to find catalog, uses :page
command to paginate catalog deployables|yes| |
|deployments|filter|y|no|uses :deployments_preset_filter and
:deployments_search params to construct redirect_to location|yes||
|deployments|index|y|retrieves pools which the current_user has
Privilege::Create on deployments, retrieves deployments in those
pools|uses :deployments_preset_filter and :deployments_search params
to filter deployments and :page param to paginate|yes| |
|deployments|create|y|requires Privileges::Create on deployments in the
pool corresponding to that specified in the :deployment param, retrieves
deployables which the current_user has Privilege::USE on, retrieves
pools which the current_user has Privilege::Create on
deployments|:deployable_id param is used to find the deployable,
:launch_parameters_encoded param is used to populate
params[:deployment][:launch_parameters], :deployment param is used to
construct a new deployment, :commit param used to direct flow
control|yes|method can be simplified? scope of respond_to should be
reduced, seems to do some steps twice|
|deployments|new|y| | | | |
|deployments|edit|y|requires Privilege::Modify on deployment specified
by :id|uses :id param to find deployment|yes||
|deployments|show|y|requires Privilege::VIEW on deployment found w/ :id
param, retrieves deployables which the current_user has Privilege::USE
on, retrieves pools which the current_user has Privilege::Create on
deployments|uses :id param to find deployment, uses
:instances_preset_filter, :instance_search params to apply_filters
to Instance, uses :detail_tab param to render view components|y|should
further permission checks be performed on instances?|
|deployments|update|y|requires Privilege::Modify on deployment specified
by :id|uses :id param to find deployment, uses :deployment param to
update_attributes of deployment found|yes||
|deployments|destroy|y|requires Privilege::Modify on deployment
specified by :id, retrieves pools which the current_user has
Privilege::Create on deployments|uses :id param to find deployment, uses
:deployment param to update_attributes of deployment found|yes| |
|instances|index|yes|instances are loaded for pools which current_user
has Privilege::CREATE on Instance|assigns params array to
params member and uses :deployment_id, :instances_preset_filter, and :instances_search params to apply_filter and where clause of Instance queries, uses :deployments_preset_filter, :deployments_search params to apply_filters to Deployment, and :page param to paginate Deployments|yes|| |instances|create|yes||||empty method, remove?| |instances|new|yes||||emtpy method, remove?| |instances|edit|yes|Privilege::MODIFY and Privilege::USE on the instance specified with :id param|:id param is used to find the instance|yes|| |instances|show|yes|instances are loaded for pools which current_user has Privilege::CREATE on Instance and requires Privilege::USE on instances specified by :id param|uses :details_tab and :details pane params to format view components, :page param to paginate instance events|yes|| |instances|update|yes|Privilege::MODIFY on instance specified w/ :id
param|uses params[:instance] to update_attributes of instance specified
by :id param|yes||
|instances|destroy|yes|Privilege::MODIFY on instance(s) specified by :id
or :ids params|:id and :ids params used to lookup instances|yes||
|instances|start|||||method not defined, remove?|
|instances|multi_stop|yes|Privilege::USE,instance on instances
specified with:instance_selected param|params[:instance_selected] used
to find Instances, params[:backlink] used as the redirect_to path on
success|yes||
|instances|multi_reboot|yes|Privilege::USE,instance on instances
specified with:instance_selected param|params[:instance_selected] used
to find Instances, params[:backlink] used as the redirect_to path on
success|yes||
|instances|remove_failed|||||method not defined, remove?|
|instances|export_events|yes|instances are loaded for pools which
current_user has Privilege::CREATE on Instance|uses :deployment_id,
:instances_preset_filter, and :instances_search params to
apply_filter and where clause of Instance queries|yes|will export.csv
be ovrerridden for each request? (will this result in a race condition
on parallel requests?)|
|instances|filter|yes|no|uses :instances_preset_filter and
:instances_search params to construct redirect_to location|yes||
|instances|key|yes|Privilege::MODIFY on
instance specified w/ :id param|uses :id to find instance|yes|| |instances|stop|yes|no!|:id is used to lookup instance|yes|| |instances|reboot|yes|no!|:id is used to lookup instance|yes|| |instance_parameters|index|||||controller does not exist, route placeholder added, never implemented| |instance_parameters|create|||||controller does not exist| |instance_parameters|new|||||controller does not exist| |instance_parameters|edit|||||controller does not exist| |instance_parameters|show|||||controller does not exist| |instance_parameters|update|||||controller does not exist| |instance_parameters|destroy|||||controller does not exist| |image_imports|index|||||controller does not exist, removed [https://github.com/aeolusproject/conductor/commit/32cbe3b1c69c14c18b35300ecb903c4e103aefa6], route should be removed| |image_imports|create|||||controller does not exist, removed| |image_imports|new|||||controller does not exist, removed| |image_imports|edit|||||controller does not exist, removed| |image_imports|show|||||controller does not exist, removed| |image_imports|update|||||controller does not exist, removed| |image_imports|destroy|||||controller does not exist, removed| |hardware_profiles|multi_destroy|yes|Privilege::MODIFY on hardware profiles specified by params[::hardware_profile_selected]|:hardware_profile_selected param used to find hardwareprofiles to destroy|yes|| |hardware_profiles|filter|yes|no (change?)|uses :hardware_profiles_preset_filter and :hardware_profiles_search params to construct redirect_to location|yes|| |hardware_profiles|index|yes|no|assigns params array to params member
and uses params[:hardware_profile] subattributes to construct new
hwp|yes||
|hardware_profiles|create|yes|Privilege::CREATE on
HardwareProfile|params[:hardware_profile] used to create a new hwp and
:commit param used to determine rendering/redirect flow control|yes|see
note about matching_provider_hardware_profiles|
|hardware_profiles|new|yes|Privilege::CREATE on
HardwareProfile|n/a|yes|
|hardware_profiles|edit|yes|Privilege::MODIFY on hardware_profile
specified by :id param|:id param is used to find User|yes|see note about
matching_provider_hardware_profiles|
|hardware_profiles|show|yes|Privilege::VIEW on
hardware_profile specified by :id param|uses :details_tab and :details pane params to format view components, :id param to lookup hwp|yes|| |hardware_profiles|update|yes|Privilege::MODIFY on hardware_profile
specified by id; and Privilege::VIEW on HardwareProfile|params[:id] used
to find hwp, params[:hardware_profile] used to construct hwp|yes|see
note about matching_provider_hardware_profiles|
|hardware_profiles|destroy|yes|Privilege::MODIFY on hardware_profile
specified by :id param|:id param is used to find User|yes||
|provider_accounts|multi_destroy|yes|requires Privilege::Modify on
provider_accounts specified by :accounts_selected param|uses
provider_id param to find provider, uses :accounts_selected param to
find provider_accounts to destroy|yes|require privilege::modify on
provider?|
|provider_accounts|set_selected_provider|yes|n/a|uses
:provider_account[:provider_id] to find provider|yes||
|provider_accounts|index|yes|retrieves provider accounts the
current_user has Privilege::VIEW on||yes||
|provider_accounts|create|yes|requires Privilege::Create on
ProviderAccounts on provider specified by
params[:provider_account][:provider_id]|uses
:provider_account[:provider] param to find provider by name, uses
:provider_account[:provider_id] param to find provider, uses
:provider_account param to create new provider, uses
:quota][:maximum_running_instances] to set_maximum_running_instance
on provider account quota|yes||
|provider_accounts|new|yes|n/a|uses :provider_id to find
provider|yes||
|provider_accounts|edit|yes|requires Privilege::Modify on
provider_account specified by :id param|uses :id to find
provider_account, uses :provider_id to find provider|yes|update method
also requires user to have Privilege::Modify on provider, need to
enforce that here by restricting which provider accounts are
retrieved?|
|provider_accounts|show|yes|retrieves provider accounts the
current_user has Privilege::VIEW on, requires Privilege::VIEW on the
provider_account specified by the :id param|uses :id param to find
provider account, uses :provider_id to find provider, uses
:details_tab param to render view components, uses :test_account param
to direct flow control|yes||
|provider_accounts|update|yes|requires Privilege::Modify on
provider_account specified by :id param, and
provider_account.provider|uses :id param to find provider_account to
update, uses :quota[:maximum_running_instances] to
set_maximum_running_instances on provider account ,uses
:provider_account param to update_attributes of provider_account
|yes||
|provider_accounts|destroy|yes|requires Privilege::Modify on
provider_account|uses :id param to find provider_account to destroy, uses :provider_id param to find provider|yes|| |providers|multi_destroy|||||method does not exist, remove| |providers|index|yes|retrieves list of providers current user has Privilege::View on|assigns params array to params
member and uses session[:current_provider_id] to find provider|yes||
|providers|create|yes|retrieves list of providers current user has
Privilege::View on and Privilege::CREATE on Provider|uses :provider
param to create new provider and lookup provider type|yes||
|providers|new|yes|retrieves list of providers current user has
Privilege::View on and requires Privilege::CREATE on Provider
|n/a|yes||
|providers|edit|yes|retrieves list of providers current user has
Privilege::View on, list of provider accounts current user has
Privilege::View on, and requires Privilege::MODIFY & Privilege::VIEW on
provider specified by :id|uses :id param to lookup provider,
:test_provider param as flow control boolean, :details_tab to format
view component|yes||
|providers|show|yes|retrieves list of providers current user has
Privilege::View on and requires Privilege::VIEW on provider specified by
:id|uses :id param to lookup provider, :test_provider param as flow
control boolean, :details_tab and :details_pane parameters to format
view components|yes||
|providers|update|yes|retrieves list of providers current user has
Privilege::View on, list of provider accounts current user has
Privilege::View on, and requires Privilege::MODIFY & Privilege::VIEW on
provider specified by :id param|uses :id param to find provider,
params[:provider] to update provider attributes, :details_tab to format
view components,:provider_accounts_preset_filter and
:provider_accounts_search to apply_filters to provider
accounts|yes||
|providers|destroy|yes|retrieves list of providers current user has
Privilege::View on and requires Privilege::MODIFY on provider specified
by :id param|uses :id param to find provider to destroy|yes||
|config_servers|test|yes|no|uses :id param to find config
server|yes|evaluated v0.9.0rc1 as 0.4.0 didn’t incorporate
config_servers|
|config_servers|index|yes||||method missing|
|config_servers|new|yes|requires Privilege::Modify on provider_account
specified by :provider_account_id param|uses :provider_account_id to
find provider_account|yes||
|config_servers|create|yes|requires Privilege::Modify on
provider_account specified by :provider_account_id param|uses
:provider_account_id to find provider_account, uses :config_server
to create new config_server|yes|calls strip! on each config_server
param|
|config_servers|edit|yes|requires Privilege::Modify on
provider_account of config_server specified by :id|uses :id to find
config_server|yes||
|config_servers|show|yes||||method missing|
|config_servers|update|yes|requires Privilege::Modify on
provider_account of config_server specified by :id param|uses :id to
find config_server to update, uses :config_server to
update_attributes of config_server found|yes|calls strip! on each
config_server param|
|config_servers|destroy|yes|requires Privilege::Modify on
provider_account of config_server specified by :id param|uses :id to
find config_server to destroy|yes||
|roles|multi_destroy|y|requires Privilege::PERM_SET|uses
:role_selected param to find roles to destroy|yes||
|roles|index|y|no?|uses :order_field, :order_dir, :page to paginate /
sort roles retrieved|yes||
|roles|create|y|requires Privilege::PERM_SET|n/a|yes|
|roles|new|y|requires Privilege::PERM_SET|uses :role param to create
new role|yes|note about roles scope needs to be flushed out|
|roles|edit|y|requires Privilege::PERM_SET|uses :id param to find the
role|yes||
|roles|show|y|requires Privilege::PERM_VIEW|uses :id param to find the
role; uses :details_tab, :details_pane params to format view
components|no|details tab param should be validated before being passed
into render partial|
|roles|update|y|requires Privilege::PERM_SET|uses :id param to find the
role; uses :commit param to direct flow control, uses :role param to
update role found|yes||
|roles|destroy|y|requires Privilege::PERM_SET|uses :id param to find
the role|yes||
|pool_families|multi_destroy|y|requires Privilege::Modify on pool
families specified by :pool_family_select param|uses
:pool_family_select param to find pool families to destroy|yes||
|pool_families|add_provider_account|y|requires Privilege::Modify on
pool family specified by :id, requires Privileges::Use on provider
accounts specified by :accounts_selected param, retrieves provider
accounts the current user has Privilege::User on|uses :id param to find
pool family, uses :accounts_selected param to find provider accounts to
add to pool family|yes||
|pool_families|remove_provider_accounts|y|requires Privilege::Modify
on pool family specified by :id|uses :id param to find pool family, uses
:accounts_selected param to find provider accounts to remove from pool
family|yes||
|pool_families|index|y|retrieves PoolFamilies which the current_user
has Privilege::View on Pool|uses :order_field, :order_dir params to
sort pool families|yes||
|pool_families|create|y|requires Privilege::Create on
PoolFamily|n/a|yes|
|pool_families|new|y|requires Privilege::Create on PoolFamily|uses
:pool_family param to create new pool family|yes||
|pool_families|edit|y|requires Privilege::Modify on pool family
specified by :id|uses :id param to find pool family|yes||
|pool_families|show|y|requires Privilege::View on pool family specified
by :id param, retrieves PoolFamilies which the current_user has
Privilege::View on Pool|uses :id to find PoolFamily, uses :order_field,
:order_dir params to sort pool families, uses details_tab param to
render view components|yes|should restrict found images?|
|pool_families|update|y|requires Privilege::Modify on pool family
specified by :id|uses :id param to find pool family, uses :pool_family
param to update_attributes of pool family|yes||
|pool_families|destroy|y|requires Privilege::Modify on pool family
specified by :id|uses :id param to find pool family|yes||
|realms|multi_destroy|y|requires Privilege::MODIFY on Realm|uses
:realm_selected param to find realms to destroy |yes|can be optimized
to call require_privilege method once|
|realms|index|y|no|uses :realms_preset_filter, :realms_search params
to apply_filters to FrontendRealms retrieved|yes||
|realms|filter|y|no (change?)|uses :realms_preset_filter and
:realms_search params to construct redirect_to location|yes||
|realms|new|y|requires Privilege::CREATE on Realm, retrieves privileges
on which current_user has Privilege::VIEW|n/a|yes||
|realms|create|y|requires Privilege::CREATE on Realm, retrieves
privileges on which current_user has Privilege::VIEW|uses
:frontend_realm param to create new realm|yes||
|realms|edit|y|requires Privilege::MODIFY on Realm, retrieves privileges
on which current_user has Privilege::VIEW|uses :id param to find
FrontendRealm|yes||
|realms|show|y|no?|uses :id param to find FrontendRealm; uses
:details_tab, :details_pane params to format view components|yes||
|realms|update|y|requires Privilege::MODIFY on Realm, retrieves
privileges on which current_user has Privilege::VIEW|uses :id param to
find FrontendRealm; uses :commit param to direct flow control, uses
:frontend_realm param to update_attributes of realm found|yes||
|realms|destroy|y|requires Privilege::MODIFY on Realm|uses :id param to
find FrontendRealm to destroy|yes||
|provider_realms|index|yes|n/a|uses :provider_realms_preset_filter,
and :provider_realms_search to apply_filters params to realms|yes
(?)|evaluated v0.9.0rc1 as 0.4.0 didn’t incorporate provider_realms,
should restrict providers retrieved in any way?|
|provider_realms|filter|yes|n/a|uses :provider_realms_preset_filter,
and :provider_realms_search params to construct redirect_to
location|yes||
|provider_realms|create|||||method does not exist|
|provider_realms|new|||||method does not exist|
|provider_realms|edit|||||method does not exist|
|provider_realms|show|yes|n/a|uses :id param to find realm, uses
:details_tab and :details pane params to format view components|yes||
|provider_realms|update|||||method does not exist|
|provider_realms|destroy|||||method does not exist|
|realm_mappings|new|yes|requires Privilege::Create on Realm, retrieves
providers which the current_user has Privilege::View on|uses
:frontend_realm_id, :realm_or_provider_type to construct
placeholder RealmBackendTarget |yes (?)|if :realm_or_provider_type
param == ‘Realm’, all realms are retrieved, want to limit this?|
|realm_mappings|multi_destroy|yes|requires Privilege::Modify on
Realm|uses :id param to find RealmBackendTarget to destroy, uses
:frontend_realm_id param to construct redirect path|yes||
|realm_mappings|index|||||method does not exist|
|realm_mappings|create|yes|requires Privilege::Create on Realm|uses
:realm_backend_targets param to create new RealmBackendTarget|yes||
|realm_mappings|edit|||||method does not exist|
|realm_mappings|show|||||method does not exist|
|realm_mappings|update|||||method does not exist|
|realm_mappings|destroy|||||method does not exist|
|deployables|multi_destroy|y|requires Privilege::Modify on deployables
found w/ :deployables_selected param|:deployables_selected param is
used to find deployable, :catalog_id param is used to find catalog if
present|no|Permission check should be enforced on catalog retrieved|
|deployables|filter|y|no (change?)|uses
:catalog_entries_preset_filter and :catalog_entries_search params
to construct redirect_to location|yes||
|deployables|definition|y|requires Privilege::View on deployable found
w/ :id param|:id param is used to find deployable|yes||
|deployables|build|y|requires Privilege::View on deployable found w/ :id
param, requires Privilege::Modify on catalog found by :catalog_id param
if present, retrieves provider accounts current_user has
Privilege::VIEW on|:id param is used to find deployable, :catalog_id
param is used to find catalog if present, uses :build_options to
determine flow control |yes||
|deployables|index|y|retrieves all deployables which current_user has
Privilege::VIEW on ‘’’only if’’’ catalog_id is not self, no permission
check otherwise|uses :catalog_id to lookup
catalog|no|uses :environment param to find pool family, sets
name member var using :name param, sets xml using :image_xml param;
:back, :make_deployable params is used to direct flow control|yes||
|images|new|y|retrieves provider accounts which current_user has
Privilege::Use on|uses :tab param to direct flow control, uses
:enviornment param to find PoolFamilies|yes||
|images|edit|||||method does not exist and should be removed|
|images|show|y|no!|uses :id param to find warehouse image, uses :build
param to select build if present|yes||
|images|update|||||method does not exist and should be removed|
|images|multi_destroy|y|no|uses :images_selected param to find image
warehouse images to destroy|yes||
|target_images|index|||||method does not exist|
|target_images|create|yes|requires Privilege::Use on pool_family of
warehouse image specified by :image_id param|uses :image_id to find
warehouse image, uses :image_id, :build_id, and :target params to
create new image factory image; uses :image_id, :build_id params to
construct redirect_path|no|should verify user has rights to warehouse
image and build, should not use global exception variables, evaluated
v0.9.0rc1 as 0.4.0 didn’t incorporate target_images|
|target_images|new|||||method does not exist|
|target_images|edit|||||method does not exist|
|target_images|show|||||method does not exist|
|target_images|update|||||method does not exist|
|target_images|destroy|yes|requires Privilege::Use on pool_family of
warehouse image specified by :image_id param|uses :image_id param to
find warehouse image, uses :id param to find warehouse target image to
destroy; uses :image_id param to construct redirect_path|yes
(?)|should require additional restrictions to delete image, look into
rescue nil bit|
|provider_images|index|||||method does not exist|
|provider_images|create|yes|requires Privilege::Use on pool_family of
warehouse image specified by :image_id param|uses :image_id to find
warehouse image, uses :account_id to find provider_account, uses
:image_id, :build_id, :target_image_id params to create new image
factory provider image; uses :image_id, :build_id to construct
redirect_to path|no|should restrict provider account to ensure user has
access; evaluated v0.9.0rc1 as 0.4.0 didn’t incorporate
provider_images|
|provider_images|new|||||method does not exist|
|provider_images|edit|||||method does not exist|
|provider_images|show|||||method does not exist|
|provider_images|update|||||method does not exist|
|provider_images|destroy|yes|requires Privilege::Use on pool_family of
warehouse image specified by :image_id param|uses :image_id param to
find warehouse image, uses :id param to find warehouse image to destroy;
uses :image_id param to construct redirect_path|yes (?)|should require
additional restrictions to delete image, look into rescue nil bit|
|provider_images|index|||||method does not exist|
|provider_types|index|yes||||yes||
|dashboard|dashboard|||||dashboard controller removed|