Cinder wasn't filtering the backups returned to backup list API

This has the side effect of return all backups in the system (regardless of
who created them) to the user. You should only see the backups created in your
current active project.

Fixes bug: 1169461

Change-Id: I121e8ed215b28f1b21e24b2104f8294039e09b48

diff --git a/cinder/db/sqlalchemy/api.py b/cinder/db/sqlalchemy/api.py
index c931dd900310c4e9e0f8553001c96dbad685389a..96dccc7d83dc58d422c07abc3c42c28e38b865f0 100644 (file)
--- a/cinder/db/sqlalchemy/api.py
+++ b/cinder/db/sqlalchemy/api.py
@@ -1957,7 +1957,8 @@ def backup_get_all_by_host(context, host):
 def backup_get_all_by_project(context, project_id):
     authorize_project_context(context, project_id)
 
-    return model_query(context, models.Backup, read_deleted="yes").all()
+    return model_query(context, models.Backup, read_deleted="yes").\
+        filter_by(project_id=project_id).all()
 
 
 @require_context

diff --git a/cinder/tests/test_backup.py b/cinder/tests/test_backup.py
index 8ffe9006c0a17f29f65a894b26ba2cd22fda429e..70a8361185fbd2f92a7123e733c8a4b1e0eadfc8 100644 (file)
--- a/cinder/tests/test_backup.py
+++ b/cinder/tests/test_backup.py
@@ -56,7 +56,8 @@ class BackupTestCase(test.TestCase):
                                 container='volumebackups',
                                 status='creating',
                                 size=0,
-                                object_count=0):
+                                object_count=0,
+                                project_id='fake'):
         """
         Create a backup entry in the DB.
         Return the entry ID
@@ -64,7 +65,7 @@ class BackupTestCase(test.TestCase):
         backup = {}
         backup['volume_id'] = volume_id
         backup['user_id'] = 'fake'
-        backup['project_id'] = 'fake'
+        backup['project_id'] = project_id
         backup['host'] = 'testhost'
         backup['availability_zone'] = '1'
         backup['display_name'] = display_name
@@ -339,3 +340,13 @@ class BackupTestCase(test.TestCase):
                           db.backup_get,
                           self.ctxt,
                           backup_id)
+
+    def test_list_backup(self):
+        backups = db.backup_get_all_by_project(self.ctxt, 'project1')
+        self.assertEqual(len(backups), 0)
+
+        b1 = self._create_backup_db_entry()
+        b2 = self._create_backup_db_entry(project_id='project1')
+        backups = db.backup_get_all_by_project(self.ctxt, 'project1')
+        self.assertEqual(len(backups), 1)
+        self.assertEqual(backups[0].id, b2)