katello 3.16.0.rc4 → 3.17.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 590a33ff3016ad29aaeca6e8d5a0c967b9053a01cf3dbf8f28fcb68b63d056bd
-  data.tar.gz: e8c30ca9e88f472f3aabf89b7f2cc3c6122750706e9bdfbb9d1cfa8aa957d4a5
+  metadata.gz: bf008f8880960ad2a6cf9b615c0e0801fb38cce104e67001f4d17178cca43ab7
+  data.tar.gz: d2cda17cc4664479ac34f7abd33c08f14ef81f038abb0cfe3d43c9542624c48b
 SHA512:
-  metadata.gz: 2fbba71f828db21edacf4100aac226a638fa7c6dd59871f6d0f029846af27ff54914c803798fd6054463ae4f44bbfc29d9466fca8a19867e63c10486668ce30c
-  data.tar.gz: 17347500daf6bb1b2dd1ff7126b97e84f2120e1c12e23066036d2f30402cdb9018dc5c6cb1f74ceff441f069a2733dceb4e3a4958032237034eaff5783915b49
+  metadata.gz: 27f052edff77986139ef6a82d0cd318c95b90a601a9f42178038896589c1042b1e18d030320173ae2c5a21ac75bfe09b13e7376525574f7dbff9d33b4867b8fa
+  data.tar.gz: 22f05c56710ee8951e1d15d30e5b2d471ab07f17287c51c01b7958e751442197fe89b8d262eb89584e612bba939aad7e8d7ddd407d55937d31a04d00e1df8e10

data/app/assets/stylesheets/katello/katello.scss

@@ -1,10 +1,3 @@
-/**
- * = require "katello/jquery.loadmask.css"
- * = require "katello/jquery-ui-1.8.11.custom.css"
- * = require "katello/jquery.treeTable.css"
- * = require "katello/ui.spinner.css"
- */
-
 @import "katello/overrides";
 @import "katello/katello_base";
 @import "katello/look";
@@ -18,6 +11,9 @@
 @import "katello/generic";
 @import "katello/notifications";
 
+@import "katello/jquery.treeTable";
+@import "katello/jquery-ui-1.8.11.custom.css";
+
 body {
   background-color: white;
 }

data/app/controllers/katello/api/registry/registry_proxies_controller.rb

@@ -6,8 +6,8 @@ module Katello
     before_action :confirm_push_settings, only: [:start_upload_blob, :upload_blob, :finish_upload_blob,
                                                  :chunk_upload_blob, :push_manifest]
     skip_before_action :authorize
-    before_action :optional_authorize, only: [:token]
-    before_action :registry_authorize, except: [:token, :v1_search]
+    before_action :optional_authorize, only: [:token, :catalog]
+    before_action :registry_authorize, except: [:token, :v1_search, :catalog]
     before_action :authorize_repository_read, only: [:pull_manifest, :tags_list]
     before_action :authorize_repository_write, only: [:push_manifest]
     skip_before_action :check_content_type, only: [:start_upload_blob, :upload_blob, :finish_upload_blob,
@@ -39,20 +39,7 @@ module Katello
                                              "scope=\"repository:registry:pull,push\""
     end
 
-    def optional_authorize
-      @repository = find_scope_repository
-      if @repository && (@repository.environment.registry_unauthenticated_pull || ssl_client_authorized?(@repository.organization.label))
-        true
-      else
-        authorize
-      end
-    end
-
-    def registry_authorize
-      @repository = find_readable_repository
-      return true if ['GET', 'HEAD'].include?(request.method) && @repository && !require_user_authorization?
-
-      token = request.headers['Authorization']
+    def set_user_by_token(token, redirect_on_failure = true)
       if token
         token_type, token = token.split
         if token_type == 'Bearer' && token
@@ -63,10 +50,34 @@ module Katello
           end
         elsif token_type == 'Basic' && token
           return true if authorize
-          redirect_authorization_headers
+          redirect_authorization_headers if redirect_on_failure
           return false
         end
       end
+      false
+    end
+
+    def optional_authorize
+      @repository = find_scope_repository
+      if @repository && (@repository.environment.registry_unauthenticated_pull || ssl_client_authorized?(@repository.organization.label))
+        true
+      elsif params['action'] == 'catalog'
+        set_user_by_token(request.headers['Authorization'], false)
+      elsif (params['action'] == 'token' && params['scope'].blank? && params['account'].blank?)
+        true
+      else
+        authorize
+      end
+    end
+
+    def registry_authorize
+      @repository = find_readable_repository
+      return true if ['GET', 'HEAD'].include?(request.method) && @repository && !require_user_authorization?
+
+      is_user_set = set_user_by_token(request.headers['Authorization'])
+
+      return true if is_user_set
+
       redirect_authorization_headers
       render_error('unauthorized', :status => :unauthorized)
       return false
@@ -87,12 +98,8 @@ module Katello
     # Also include repositories in lifecycle environments with registry_unauthenticated_pull=true
     def readable_repositories
       table_name = Repository.table_name
-      in_products = Repository.in_product(Katello::Product.authorized(:view_products)).select(:id)
-      in_environments = Repository.where(:environment_id => Katello::KTEnvironment.authorized(:view_lifecycle_environments)).select(:id)
       in_unauth_environments = Repository.joins(:environment).where("#{Katello::KTEnvironment.table_name}.registry_unauthenticated_pull" => true).select(:id)
-      in_content_views = Repository.joins(:content_view_repositories).where("#{ContentViewRepository.table_name}.content_view_id" => Katello::ContentView.readable).select(:id)
-      in_versions = Repository.joins(:content_view_version).where("#{Katello::ContentViewVersion.table_name}.content_view_id" => Katello::ContentView.readable).select(:id)
-      Repository.where("#{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?)", in_products, in_content_views, in_versions, in_environments, in_unauth_environments)
+      Repository.readable.or(Repository.joins(:root).where("#{table_name}.id in (?)", in_unauth_environments))
     end
 
     def find_readable_repository
@@ -105,7 +112,8 @@ module Katello
     end
 
     def require_user_authorization?(repository = @repository)
-      !repository || (!repository.environment.registry_unauthenticated_pull && !ssl_client_authorized?(repository.organization.label))
+      !(params['action'] == 'token' && params['scope'].blank? && params['account'].blank?) &&
+        (!repository || (!repository.environment.registry_unauthenticated_pull && !ssl_client_authorized?(repository.organization.label)))
     end
 
     def ssl_client_authorized?(org_label)
@@ -293,6 +301,14 @@ module Katello
     end
 
     def v1_search
+      # Checks for podman client and issues a 404 in that case. Podman
+      # examines the response from a /v1_search request. If the result
+      # is a 4XX, it will then proceed with a request to /_catalog
+      if request.headers['HTTP_USER_AGENT'].downcase.include?('libpod')
+        render json: {}, status: :not_found
+        return
+      end
+
       authenticate # to set current_user, not to enforce
       options = {
         resource_class: Katello::Repository

data/app/controllers/katello/api/rhsm/candlepin_proxies_controller.rb

@@ -268,8 +268,8 @@ module Katello
     end
 
     def get_parent_host(headers)
-      hostnames = headers["HTTP_X_FORWARDED_SERVER"]
-      host = hostnames.split(",")[0] if hostnames
+      hostnames = headers["HTTP_X_FORWARDED_HOST"]
+      host = hostnames.split(/[\,,:]/)[0].strip if hostnames
       host || URI.parse(Setting[:foreman_url]).host
     end
 

data/app/controllers/katello/api/v2/activation_keys_controller.rb

@@ -1,4 +1,5 @@
 module Katello
+  # rubocop:disable Metrics/ClassLength
   class Api::V2::ActivationKeysController < Api::V2::ApiController
     include Katello::Concerns::FilteredAutoCompleteSearch
     include Katello::Concerns::Api::V2::ContentOverridesController
@@ -11,6 +12,7 @@ module Katello
                                                   :content_override, :add_subscriptions, :remove_subscriptions,
                                                   :subscriptions]
     before_action :authorize
+    before_action :verify_simple_content_access_disabled, :only => [:add_subscriptions]
 
     wrap_parameters :include => (ActivationKey.attribute_names + %w(host_collection_ids service_level auto_attach purpose_role purpose_usage purpose_addons content_view_environment))
 
@@ -348,5 +350,11 @@ module Katello
 
       key_params
     end
+
+    def verify_simple_content_access_disabled
+      if @activation_key.organization.simple_content_access?
+        fail HttpErrors::BadRequest, _("The specified organization is in Simple Content Access mode. Attaching subscriptions is disabled")
+      end
+    end
   end
 end

data/app/controllers/katello/api/v2/api_controller.rb

@@ -5,6 +5,7 @@ module Katello
     include Api::V2::Rendering
     include Api::V2::ErrorHandling
     include ::Foreman::Controller::CsvResponder
+    include Concerns::Api::V2::AssociationsPermissionCheck
 
     # support for session (thread-local) variables must be the last filter in this class
     include Foreman::ThreadSession::Cleaner

data/app/controllers/katello/api/v2/content_view_filters_controller.rb

@@ -37,6 +37,8 @@ module Katello
     param :type, String, :desc => N_("type of filter (e.g. rpm, package_group, erratum, docker, modulemd)"), :required => true
     param :original_packages, :bool, :desc => N_("add all packages without errata to the included/excluded list. " \
                                                        "(package filter only)")
+    param :original_module_streams, :bool, :desc => N_("add all module streams without errata to the included/excluded list. " \
+                                                       "(module stream filter only)")
     param :inclusion, :bool, :desc => N_("specifies if content should be included or excluded, default: inclusion=false")
     param :repository_ids, Array, :desc => N_("list of repository ids")
     param :description, String, :desc => N_("description of the filter")
@@ -60,6 +62,8 @@ module Katello
     param :name, String, :desc => N_("new name for the filter")
     param :original_packages, :bool, :desc => N_("add all packages without errata to the included/excluded list. " \
                                                        "(package filter only)")
+    param :original_module_streams, :bool, :desc => N_("add all module streams without errata to the included/excluded list. " \
+                                                       "(module stream filter only)")
     param :inclusion, :bool, :desc => N_("specifies if content should be included or excluded, default: inclusion=false")
     param :repository_ids, Array, :desc => N_("list of repository ids")
     param :description, String, :desc => N_("description of the filter"), :required => false
@@ -95,7 +99,7 @@ module Katello
     end
 
     def filter_params
-      params.require(:content_view_filter).permit(:name, :inclusion, :original_packages, :description, :repository_ids => [])
+      params.require(:content_view_filter).permit(:name, :inclusion, :original_packages, :original_module_streams, :description, :repository_ids => [])
     end
   end
 end

data/app/controllers/katello/api/v2/content_view_versions_controller.rb

@@ -143,6 +143,9 @@ module Katello
       end
     end
     def incremental_update
+      if params[:add_content].values.flatten.empty?
+        fail HttpErrors::BadRequest, _("Incremental update requires at least one content unit")
+      end
       any_environments = params[:content_view_version_environments].any? { |cvve| cvve[:environment_ids].try(:any?) }
       if params[:add_content]&.key?(:errata_ids) && params[:update_hosts] && any_environments
         hosts = calculate_hosts_for_incremental(params[:update_hosts], params[:propagate_to_composites])

data/app/controllers/katello/api/v2/content_views_controller.rb

@@ -22,6 +22,13 @@ module Katello
       param :solve_dependencies, :bool, :desc => N_("Solve RPM dependencies by default on Content View publish, defaults to false")
     end
 
+    def filtered_associations
+      {
+        :component_ids => Katello::ContentViewVersion,
+        :repository_ids => Katello::Repository
+      }
+    end
+
     api :GET, "/organizations/:organization_id/content_views", N_("List content views")
     api :GET, "/content_views", N_("List content views")
     param :organization_id, :number, :desc => N_("organization identifier")

data/app/controllers/katello/api/v2/host_subscriptions_controller.rb

@@ -39,7 +39,9 @@ module Katello
       respond_for_index :collection => @collection
     end
 
-    def index_response
+    def index_response(reload_host = false)
+      # Host needs to be reloaded because of lazy accessor
+      @host.reload if reload_host
       entitlements = @host.subscription_facet.candlepin_consumer.entitlements
       subscriptions = entitlements.map { |entitlement| ::Katello::HostSubscriptionPresenter.new(entitlement) }
       full_result_response(subscriptions)
@@ -53,7 +55,7 @@ module Katello
       end
 
       sync_task(::Actions::Katello::Host::AutoAttachSubscriptions, @host)
-      respond_for_index(:collection => index_response, :template => "index")
+      respond_for_index(:collection => index_response(true), :template => "index")
     end
 
     api :DELETE, "/hosts/:host_id/subscriptions/", N_("Unregister the host as a subscription consumer")
@@ -124,7 +126,7 @@ module Katello
       end
 
       sync_task(::Actions::Katello::Host::RemoveSubscriptions, @host, pool_id_quantities.values)
-      respond_for_index(:collection => index_response, :template => "index")
+      respond_for_index(:collection => index_response(true), :template => "index")
     end
 
     api :PUT, "/hosts/:host_id/subscriptions/add_subscriptions", N_("Add a subscription to a host")
@@ -134,12 +136,16 @@ module Katello
       param :quantity, :number, :desc => N_("Quantity of this subscriptions to add"), :required => true
     end
     def add_subscriptions
+      if @host.organization.simple_content_access?
+        fail ::Katello::HttpErrors::BadRequest, _("This host's organization is in Simple Content Access mode. Attaching subscriptions is disabled.")
+      end
+
       pools_with_quantities = params.require(:subscriptions).map do |sub_params|
         PoolWithQuantities.new(Pool.with_identifier(sub_params['id']), sub_params['quantity'].to_i)
       end
 
       sync_task(::Actions::Katello::Host::AttachSubscriptions, @host, pools_with_quantities)
-      respond_for_index(:collection => index_response, :template => "index")
+      respond_for_index(:collection => index_response(true), :template => "index")
     end
 
     api :PUT, "/hosts/:host_id/subscriptions/content_override", N_("Set content overrides for the host")

data/app/controllers/katello/api/v2/hosts_bulk_actions_controller.rb

@@ -10,9 +10,11 @@ module Katello
     before_action :find_deletable_hosts, :only => [:destroy_hosts]
     before_action :find_readable_hosts, :only => [:applicable_errata, :installable_errata, :available_incremental_updates]
     before_action :find_errata, :only => [:available_incremental_updates]
+    before_action :find_organization, :only => [:add_subscriptions]
     before_action :deprecate_katello_agent, :only => [:install_content, :update_content, :remove_content]
 
     before_action :validate_content_action, :only => [:install_content, :update_content, :remove_content]
+    before_action :validate_organization, :only => [:add_subscriptions]
 
     # disable *_count fields on erratum rabl, since they perform N+1 queries
     before_action :disable_erratum_hosts_count
@@ -173,6 +175,10 @@ module Katello
       param :quantity, :number, :desc => N_("Quantity of this subscriptions to add"), :required => true
     end
     def add_subscriptions
+      if @organization.simple_content_access?
+        fail HttpErrors::BadRequest, _("The specified organization is in Simple Content Access mode. Attaching subscriptions is disabled")
+      end
+
       pools_with_quantities = params.require(:subscriptions).map do |sub_params|
         PoolWithQuantities.new(Pool.find(sub_params['id']), sub_params['quantity'])
       end
@@ -295,6 +301,10 @@ module Katello
       find_bulk_hosts(:destroy_hosts, params)
     end
 
+    def validate_organization
+      fail HttpErrors::BadRequest, _("Organization ID is required") if @organization.blank?
+    end
+
     def validate_host_collection_membership_limit
       max_hosts_exceeded = []
       host_ids = @hosts.map(&:id)

data/app/controllers/katello/api/v2/repositories_controller.rb

@@ -57,6 +57,7 @@ module Katello
       param :ansible_collection_requirements, String, :desc => N_("Contents of requirement yaml file to sync from URL")
       param :http_proxy_policy, ::Katello::RootRepository::HTTP_PROXY_POLICIES, :desc => N_("policies for HTTP proxy for content sync")
       param :http_proxy_id, :number, :desc => N_("ID of a HTTP Proxy")
+      param :auto_enabled, :bool, :desc => N_("if true, the repositories will be automatically enabled on a registered host subscribed to this product. Default: true")
     end
 
     def_param_group :repo_create do
@@ -327,6 +328,7 @@ module Katello
     api :PUT, "/repositories/:id", N_("Update a repository")
     param :id, :number, :required => true, :desc => N_("repository ID")
     param :name, String, :required => false
+    param :description, String, :desc => N_("description of the repository"), :required => false
     param_group :repo
     def update
       repo_params = repository_params
@@ -463,7 +465,7 @@ module Katello
 
     def repository_params
       keys = [:download_policy, :mirror_on_sync, :arch, :verify_ssl_on_sync, :upstream_password, :upstream_username,
-              :ostree_upstream_sync_depth, :ostree_upstream_sync_policy,
+              :ostree_upstream_sync_depth, :ostree_upstream_sync_policy, :auto_enabled,
               :deb_releases, :deb_components, :deb_architectures, :description, :http_proxy_policy, :http_proxy_id,
               {:ignorable_content => []}
              ]
@@ -514,6 +516,7 @@ module Katello
       root.ansible_collection_requirements = repo_params[:ansible_collection_requirements] if root.ansible_collection?
       root.http_proxy_policy = repo_params[:http_proxy_policy] if repo_params.key?(:http_proxy_policy)
       root.http_proxy_id = repo_params[:http_proxy_id] if repo_params.key?(:http_proxy_id)
+      root.auto_enabled = repo_params[:auto_enabled] if repo_params.key?(:auto_enabled)
 
       if root.ostree?
         root.ostree_upstream_sync_policy = repo_params[:ostree_upstream_sync_policy]

data/app/controllers/katello/api/v2/upstream_subscriptions_controller.rb

@@ -77,6 +77,22 @@ module Katello
       render json: { status: 'OK' }
     end
 
+    api :PUT, "/organizations/:organization_id/simple_content_access/enable",
+      N_("Enable simple content access for a manifest")
+    param :organization_id, :number, :desc => N_("Organization ID"), :required => true
+    def enable_simple_content_access
+      task = async_task(::Actions::Katello::Organization::SimpleContentAccess::Enable, params[:organization_id])
+      respond_for_async :resource => task
+    end
+
+    api :PUT, "/organizations/:organization_id/simple_content_access/disable",
+      N_("Disable simple content access for a manifest")
+    param :organization_id, :number, :desc => N_("Organization ID"), :required => true
+    def disable_simple_content_access
+      task = async_task(::Actions::Katello::Organization::SimpleContentAccess::Disable, params[:organization_id])
+      respond_for_async :resource => task
+    end
+
     private
 
     def update_params

data/app/controllers/katello/concerns/api/v2/associations_permission_check.rb

@@ -0,0 +1,67 @@
+module Katello
+  module Concerns
+    module Api::V2::AssociationsPermissionCheck
+      extend ActiveSupport::Concern
+
+      # The purpose of this module is to protect a controller from a user creating or updating some association
+      # when they do not have permissions to view the associated items.  An example would be adding random repository ids to
+      # content view.
+      # To support this, within the controller define a method such as:
+      #     def filtered_associations
+      #       {
+      #         :component_ids => Katello::ContentViewVersion,
+      #         :repository_ids => Katello::Repository
+      #       }
+      #     end
+      # This assumes that the parameters are 'wrapped'.  So the above in the content_views_controller, actually looks at
+      #  a subhash of 'content_view'
+
+      included do
+        before_action :check_association_ids, :only => [:create, :update]
+      end
+
+      def check_association_ids
+        if filtered_associations
+          wrapped_params = params[self._wrapper_options.name]
+          find_param_arrays(wrapped_params).each do |key_path|
+            if (model_class = filtered_associations.with_indifferent_access.dig(*key_path))
+              param_ids = wrapped_params.dig(*key_path)
+              filtered_ids = model_class.readable.where(:id => param_ids).pluck(:id)
+              if (unfound_ids = param_ids_missing(param_ids, filtered_ids)).any?
+                fail HttpErrors::NotFound, _("One or more ids (%{ids}) were not found for %{assoc}.  You may not have permissions to see them.") %
+                    {ids: unfound_ids, assoc: key_path.last}
+              end
+            else
+              fail _("Unfiltered params array: %s.") % key_path
+            end
+          end
+        else
+          Rails.logger.warn("#{self.class.name} may has unprotected associations, see associations_permission_check.rb for details.") if ENV['RAILS_ENV'] == 'development'
+        end
+      end
+
+      def filtered_associations
+        #should return {} when supported by all controllers
+        nil
+      end
+
+      def param_ids_missing(param_ids, filtered_ids)
+        param_ids.map(&:to_i).uniq - filtered_ids.map(&:to_i).uniq
+      end
+
+      #returns an array of list of keys pointing to an array in a params hash i.e.:
+      # {"a"=> {"b" => [3]}}  =>  [["a", "b"]]
+      def find_param_arrays(hash = params)
+        list_of_paths = []
+        hash.each do |key, value|
+          if value.is_a?(ActionController::Parameters) || value.is_a?(Hash)
+            list_of_paths += find_param_arrays(value).compact.map { |inner_keys| [key] + inner_keys }
+          elsif value.is_a?(Array)
+            list_of_paths << [key]
+          end
+        end
+        list_of_paths.compact
+      end
+    end
+  end
+end

data/app/controllers/katello/concerns/api/v2/bulk_hosts_extensions.rb

@@ -5,19 +5,19 @@ module Katello
 
       def find_bulk_hosts(permission, bulk_params, restrict_to = nil)
         #works on a structure of param_group bulk_params and transforms it into a list of systems
-        organization = find_organization
+        find_organization
         bulk_params[:included] ||= {}
         bulk_params[:excluded] ||= {}
         @hosts = []
 
         unless bulk_params[:included][:ids].blank?
           @hosts = ::Host::Managed.authorized(permission).where(:id => bulk_params[:included][:ids])
-          @hosts = @hosts.where(:organization_id => organization.id) if organization
+          @hosts = @hosts.where(:organization_id => @organization.id) if @organization
         end
 
         if bulk_params[:included][:search]
           search_hosts = ::Host::Managed.authorized(permission)
-          search_hosts = search_hosts.where(:organization_id => organization_id) if params[:organization_id]
+          search_hosts = search_hosts.where(:organization_id => @organization.id) if @organization
           search_hosts = search_hosts.search_for(bulk_params[:included][:search])
           if @hosts.any?
             @hosts = ::Host.where(id: @hosts).or(::Host.where(id: search_hosts))
@@ -38,7 +38,7 @@ module Katello
       end
 
       def find_organization
-        Organization.find_by_id(params[:organization_id])
+        @organization ||= Organization.find_by_id(params[:organization_id])
       end
     end
   end