Docker/portainer
Docker/portainer
1
0
Fork 0
mirror of https://github.com/portainer/portainer.git synced 2025-07-19 05:19:39 +02:00
Code Issues Releases Activity

fix(api/endpoints): filter out waiting room environments for non admins (#810)

Browse source
This commit is contained in:
LP B 2025-06-30 15:35:51 +02:00 • committed by GitHub
parent 0556ffb4a1
commit b43f864511
3 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
api/http/handler/endpoints/endpoint_list.go
View file

@ -95,12 +95,11 @@ func (handler *Handler) endpointList(w http.ResponseWriter, r *http.Request) *ht
return httperror.BadRequest("Invalid query parameters", err) return httperror.BadRequest("Invalid query parameters", err)
} }
filteredEndpoints := security.FilterEndpoints(endpoints, endpointGroups, securityContext) filteredEndpoints, totalAvailableEndpoints, err := handler.filterEndpointsByQuery(endpoints, query, endpointGroups, edgeGroups, settings, securityContext)
filteredEndpoints, totalAvailableEndpoints, err := handler.filterEndpointsByQuery(filteredEndpoints, query, endpointGroups, edgeGroups, settings)
if err != nil { if err != nil {
return httperror.InternalServerError("Unable to filter endpoints", err) return httperror.InternalServerError("Unable to filter endpoints", err)
} }
filteredEndpoints = security.FilterEndpoints(filteredEndpoints, endpointGroups, securityContext)
sortEnvironmentsByField(filteredEndpoints, endpointGroups, getSortKey(sortField), sortOrder == "desc") sortEnvironmentsByField(filteredEndpoints, endpointGroups, getSortKey(sortField), sortOrder == "desc")

7
api/http/handler/endpoints/filter.go
View file

@ -11,6 +11,7 @@ import (
portainer "github.com/portainer/portainer/api" portainer "github.com/portainer/portainer/api"
"github.com/portainer/portainer/api/dataservices" "github.com/portainer/portainer/api/dataservices"
"github.com/portainer/portainer/api/http/handler/edgegroups" "github.com/portainer/portainer/api/http/handler/edgegroups"
"github.com/portainer/portainer/api/http/security"
"github.com/portainer/portainer/api/internal/edge" "github.com/portainer/portainer/api/internal/edge"
"github.com/portainer/portainer/api/internal/endpointutils" "github.com/portainer/portainer/api/internal/endpointutils"
"github.com/portainer/portainer/api/slicesx" "github.com/portainer/portainer/api/slicesx"
@ -140,6 +141,7 @@ func (handler *Handler) filterEndpointsByQuery(
groups []portainer.EndpointGroup, groups []portainer.EndpointGroup,
edgeGroups []portainer.EdgeGroup, edgeGroups []portainer.EdgeGroup,
settings *portainer.Settings, settings *portainer.Settings,
context *security.RestrictedRequestContext,
) ([]portainer.Endpoint, int, error) { ) ([]portainer.Endpoint, int, error) {
totalAvailableEndpoints := len(filteredEndpoints) totalAvailableEndpoints := len(filteredEndpoints)
@ -181,11 +183,16 @@ func (handler *Handler) filterEndpointsByQuery(
} }
// filter edge environments by trusted/untrusted // filter edge environments by trusted/untrusted
// only portainer admins are allowed to see untrusted environments
filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool { filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
if !endpointutils.IsEdgeEndpoint(&endpoint) { if !endpointutils.IsEdgeEndpoint(&endpoint) {
return true return true
} }
if query.edgeDeviceUntrusted {
return !endpoint.UserTrusted && context.IsAdmin
}
return endpoint.UserTrusted == !query.edgeDeviceUntrusted return endpoint.UserTrusted == !query.edgeDeviceUntrusted
}) })

2
api/http/handler/endpoints/filter_test.go
View file

@ -6,6 +6,7 @@ import (
portainer "github.com/portainer/portainer/api" portainer "github.com/portainer/portainer/api"
"github.com/portainer/portainer/api/datastore" "github.com/portainer/portainer/api/datastore"
"github.com/portainer/portainer/api/http/security"
"github.com/portainer/portainer/api/internal/testhelpers" "github.com/portainer/portainer/api/internal/testhelpers"
"github.com/portainer/portainer/api/slicesx" "github.com/portainer/portainer/api/slicesx"
@ -263,6 +264,7 @@ func runTest(t *testing.T, test filterTest, handler *Handler, endpoints []portai
[]portainer.EndpointGroup{}, []portainer.EndpointGroup{},
[]portainer.EdgeGroup{}, []portainer.EdgeGroup{},
&portainer.Settings{}, &portainer.Settings{},
&security.RestrictedRequestContext{IsAdmin: true},
) )
is.NoError(err) is.NoError(err)