github
/
portainer
mirror of https://github.com/portainer/portainer
1
0
Fork 0
Code Issues Releases Wiki Activity

fix(service-details): prevent regular users from using bind mounts (#1778)

pull/1744/merge
Anthony Lapenna 2018-03-29 18:41:47 +11:00 committed by GitHub
parent eca39b11a8
commit 8d32703456
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/docker/views/services/edit/includes/mounts.html
View File

@ -14,7 +14,7 @@
<table class="table" > <table class="table" >
<thead> <thead>
<tr> <tr>
<th>Type</th> <th ng-if="isAdmin || allowBindMounts">Type</th>
<th>Source</th> <th>Source</th>
<th>Target</th> <th>Target</th>
<th>Read only</th> <th>Read only</th>
@ -23,14 +23,17 @@
</thead> </thead>
<tbody> <tbody>
<tr ng-repeat="mount in service.ServiceMounts"> <tr ng-repeat="mount in service.ServiceMounts">
<td> <td ng-if="isAdmin || allowBindMounts">
<select name="mountType" class="form-control" ng-model="mount.Type" ng-disabled="isUpdating"> <select name="mountType" class="form-control" ng-model="mount.Type" ng-disabled="isUpdating">
<option value="volume">Volume</option> <option value="volume">Volume</option>
<option value="bind">Bind</option> <option value="bind">Bind</option>
</select> </select>
</td> </td>
<td> <td>
<input type="text" class="form-control" ng-model="mount.Source" placeholder="e.g. /tmp/portainer/data" ng-change="updateMount(service, mount)" ng-disabled="isUpdating"> <select class="form-control" ng-model="mount.Source" ng-options="vol.Id|truncate:30 as vol.Id for vol in availableVolumes" ng-if="mount.Type === 'volume'">
<option selected disabled hidden value="">Select a volume</option>
</select>
<input type="text" class="form-control" ng-model="mount.Source" placeholder="e.g. /tmp/portainer/data" ng-change="updateMount(service, mount)" ng-disabled="isUpdating || (!isAdmin && !allowBindMounts && mount.Type === 'bind')" ng-if="mount.Type === 'bind'">
</td> </td>
<td> <td>
<input type="text" class="form-control" ng-model="mount.Target" placeholder="e.g. /tmp/portainer/data" ng-change="updateMount(service, mount)" ng-disabled="isUpdating"> <input type="text" class="form-control" ng-model="mount.Target" placeholder="e.g. /tmp/portainer/data" ng-change="updateMount(service, mount)" ng-disabled="isUpdating">

12
app/docker/views/services/edit/serviceController.js
View File

@ -1,6 +1,6 @@
angular.module('portainer.docker') angular.module('portainer.docker')
.controller('ServiceController', ['$q', '$scope', '$transition$', '$state', '$location', '$timeout', '$anchorScroll', 'ServiceService', 'ConfigService', 'ConfigHelper', 'SecretService', 'ImageService', 'SecretHelper', 'Service', 'ServiceHelper', 'LabelHelper', 'TaskService', 'NodeService', 'Notifications', 'ModalService', 'PluginService', .controller('ServiceController', ['$q', '$scope', '$transition$', '$state', '$location', '$timeout', '$anchorScroll', 'ServiceService', 'ConfigService', 'ConfigHelper', 'SecretService', 'ImageService', 'SecretHelper', 'Service', 'ServiceHelper', 'LabelHelper', 'TaskService', 'NodeService', 'Notifications', 'ModalService', 'PluginService', 'Authentication', 'SettingsService', 'VolumeService',
function ($q, $scope, $transition$, $state, $location, $timeout, $anchorScroll, ServiceService, ConfigService, ConfigHelper, SecretService, ImageService, SecretHelper, Service, ServiceHelper, LabelHelper, TaskService, NodeService, Notifications, ModalService, PluginService) { function ($q, $scope, $transition$, $state, $location, $timeout, $anchorScroll, ServiceService, ConfigService, ConfigHelper, SecretService, ImageService, SecretHelper, Service, ServiceHelper, LabelHelper, TaskService, NodeService, Notifications, ModalService, PluginService, Authentication, SettingsService, VolumeService) {
$scope.state = { $scope.state = {
updateInProgress: false, updateInProgress: false,
@ -423,12 +423,14 @@ function ($q, $scope, $transition$, $state, $location, $timeout, $anchorScroll,
originalService = angular.copy(service); originalService = angular.copy(service);
return $q.all({ return $q.all({
volumes: VolumeService.volumes(),
tasks: TaskService.tasks({ service: [service.Name] }), tasks: TaskService.tasks({ service: [service.Name] }),
nodes: NodeService.nodes(), nodes: NodeService.nodes(),
secrets: apiVersion >= 1.25 ? SecretService.secrets() : [], secrets: apiVersion >= 1.25 ? SecretService.secrets() : [],
configs: apiVersion >= 1.30 ? ConfigService.configs() : [], configs: apiVersion >= 1.30 ? ConfigService.configs() : [],
availableImages: ImageService.images(), availableImages: ImageService.images(),
availableLoggingDrivers: PluginService.loggingPlugins(apiVersion < 1.25) availableLoggingDrivers: PluginService.loggingPlugins(apiVersion < 1.25),
settings: SettingsService.publicSettings()
}); });
}) })
.then(function success(data) { .then(function success(data) {
@ -438,6 +440,10 @@ function ($q, $scope, $transition$, $state, $location, $timeout, $anchorScroll,
$scope.secrets = data.secrets; $scope.secrets = data.secrets;
$scope.availableImages = ImageService.getUniqueTagListFromImages(data.availableImages); $scope.availableImages = ImageService.getUniqueTagListFromImages(data.availableImages);
$scope.availableLoggingDrivers = data.availableLoggingDrivers; $scope.availableLoggingDrivers = data.availableLoggingDrivers;
$scope.availableVolumes = data.volumes;
$scope.allowBindMounts = data.settings.AllowBindMountsForRegularUsers;
var userDetails = Authentication.getUserDetails();
$scope.isAdmin = userDetails.role === 1;
// Set max cpu value // Set max cpu value
var maxCpus = 0; var maxCpus = 0;