{"action":"created","issue":{"url":"https://api.github.com/repos/apache/cloudstack/issues/1006","labels_url":"https://api.github.com/repos/apache/cloudstack/issues/1006/labels{/name}","comments_url":"https://api.github.com/repos/apache/cloudstack/issues/1006/comments","events_url":"https://api.github.com/repos/apache/cloudstack/issues/1006/events","html_url":"https://github.com/apache/cloudstack/pull/1006","id":114046205,"number":1006,"title":"Fixed user_vm_view to only display keypairs belonging to the account.","user":{"login":"nnesic","id":1624034,"avatar_url":"https://avatars.githubusercontent.com/u/1624034?v=3","gravatar_id":"","url":"https://api.github.com/users/nnesic","html_url":"https://github.com/nnesic","followers_url":"https://api.github.com/users/nnesic/followers","following_url":"https://api.github.com/users/nnesic/following{/other_user}","gists_url":"https://api.github.com/users/nnesic/gists{/gist_id}","starred_url":"https://api.github.com/users/nnesic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nnesic/subscriptions","organizations_url":"https://api.github.com/users/nnesic/orgs","repos_url":"https://api.github.com/users/nnesic/repos","events_url":"https://api.github.com/users/nnesic/events{/privacy}","received_events_url":"https://api.github.com/users/nnesic/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-29T13:11:07Z","updated_at":"2015-10-30T10:51:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/cloudstack/pulls/1006","html_url":"https://github.com/apache/cloudstack/pull/1006","diff_url":"https://github.com/apache/cloudstack/pull/1006.diff","patch_url":"https://github.com/apache/cloudstack/pull/1006.patch"},"body":"The user_vm_view displayes the keypair information by joining vm_details with ssh_keypairs on the key value exclusively. \r\n\r\nWe found a scenario in which this can cause information leakage. If there are two accounts using the same key, but create a different key name for it, and then a vm is created using one of the keys, the view will list both keypairs as belonging to the vm, which can in turn cause confusion to the users who see a keypair name which they did not create. \r\n\r\nThe fix simply limits the view to displaying keypairs which belong to vm's account. \r\n\r\nI added it to the latest schema migration only; should I also include it in the previous ones? "},"comment":{"url":"https://api.github.com/repos/apache/cloudstack/issues/comments/152493863","html_url":"https://github.com/apache/cloudstack/pull/1006#issuecomment-152493863","issue_url":"https://api.github.com/repos/apache/cloudstack/issues/1006","id":152493863,"user":{"login":"karuturi","id":186833,"avatar_url":"https://avatars.githubusercontent.com/u/186833?v=3","gravatar_id":"","url":"https://api.github.com/users/karuturi","html_url":"https://github.com/karuturi","followers_url":"https://api.github.com/users/karuturi/followers","following_url":"https://api.github.com/users/karuturi/following{/other_user}","gists_url":"https://api.github.com/users/karuturi/gists{/gist_id}","starred_url":"https://api.github.com/users/karuturi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karuturi/subscriptions","organizations_url":"https://api.github.com/users/karuturi/orgs","repos_url":"https://api.github.com/users/karuturi/repos","events_url":"https://api.github.com/users/karuturi/events{/privacy}","received_events_url":"https://api.github.com/users/karuturi/received_events","type":"User","site_admin":false},"created_at":"2015-10-30T10:51:59Z","updated_at":"2015-10-30T10:51:59Z","body":"Manual Testing:\r\nBefore:\r\nssh_keypairs\r\n```\r\nmysql> select * from ssh_keypairs;\r\n+----+------------+-----------+--------------+-------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n| id | account_id | domain_id | keypair_name | fingerprint                                     | public_key                                                                                                                                                                                                           |\r\n+----+------------+-----------+--------------+-------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n|  1 |         60 |         3 | rajani       | 60:f3:cb:9b:c4:b8:c1:cd:36:13:3a:28:17:26:01:b2 | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDo6DcY9r8Br56JUD2Vv33KNiieElPQV0+Qepz+8lGHlIlYn8I2ubXcVOrGBtET6JGlHqVlSmjKEjeHXcvILPZsxxMjGX4skPQtBVOaH1kQcYU2YpYxxm5piQPpOo263AkWmQrfBb/W0n8ChWfOuBSYvbpzdqATsQUGnNCQuthBKQ== |\r\n|  3 |         62 |         3 | bharat       | 69:72:47:63:10:aa:76:37:d9:fc:c2:51:66:1e:b9:93 | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDo6DcY9r8Br56JUD2Vv33KNiieElPQV0+Qepz+8lGHlIlYn8I2ubXcVOrGBtET6JGlHqVlSmjKEjeHXcvILPZsxxMjGX4skPQtBVOaH1kQcYU2YpYxxm5piQPpOo263AkWmQrfBb/W0n8ChWfOuBSYvbpzdqATsQUGnNCQuthBKQ== |\r\n+----+------------+-----------+--------------+-------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n```\r\nuser_vm_view;\r\n```\r\nmysql> select id,name,account_name,keypair_name from user_vm_view;\r\n+----+------+--------------+--------------+\r\n| id | name | account_name | keypair_name |\r\n+----+------+--------------+--------------+\r\n| 67 | rvm1 | rajanik      | rajani       |\r\n| 68 | bvm1 | bharatk      | rajani       |\r\n| 67 | rvm1 | rajanik      | bharat       |\r\n| 68 | bvm1 | bharatk      | bharat       |\r\n+----+------+--------------+--------------+\r\n```\r\nUi vm screenshot:\r\n![screen shot 2015-10-30 at 3 30 01 pm](https://cloud.githubusercontent.com/assets/186833/10843914/f732beee-7f21-11e5-9682-c5207f3c4dfd.png)\r\n\r\n\r\n1. checked out the PR\r\n2. did mvn clean install -Pdeveloper,systemvm on an existing setup\r\n3. manually ran the drop view and create view query\r\n4. start jetty mvn  -pl client jetty:run -o\r\n\r\nAfter the change.\r\n\r\n```\r\nuser_vm_view\r\nmysql> select id,name,account_name,keypair_name from user_vm_view;\r\n+----+------+--------------+--------------+\r\n| id | name | account_name | keypair_name |\r\n+----+------+--------------+--------------+\r\n| 67 | rvm1 | rajanik      | rajani       |\r\n| 68 | bvm1 | bharatk      | bharat       |\r\n+----+------+--------------+--------------+\r\n2 rows in set (0.00 sec)\r\n```\r\nUI Vm screenshot\r\n![screen shot 2015-10-30 at 3 37 13 pm](https://cloud.githubusercontent.com/assets/186833/10843965/374adcc8-7f22-11e5-8e06-65a22040e5d4.png)\r\n\r\n:+1: \r\n\r\nCan you create an issue for this in jira and add it to the commit message please?"}}