ManageIQ / manageiq / 45698

49%

master: 63%

push

travis-ci

Merge branch '1382756-hotfix-vm-ops-security-vuln-5.6' into '5.6.z'

Perform RBAC user filter check on requested ids before allowing requested operations to proceed.

This addresses a vulnerability where a user can change the targeted ids in the browser console to allow
operations like power on/off on VMs that he is not entitled access. This is a short term targeted hot fix
as there are more places in the code with a similar exposure.

https://bugzilla.redhat.com/show_bug.cgi?id=1382756
Closes #1382756

See merge request !1048

7 of 7 new or added lines in 2 files covered. (100.0%)

87772 of 244592 relevant lines covered (35.89%)

155.44 hits per line