Oved Ourfali has posted comments on this change. Change subject: engine : User can see events which don't belong to him ......................................................................
Patch Set 3: The new view you created is a direct view, which means it only returns direct permissions. Now, you used this view in the get audit log events procedure, to decide whether or not to return an event, so, iiuc, you will only return events on entities that the user has direct permission on. Maybe I'm missing something, but that's what I understand from the code review. -- To view, visit http://gerrit.ovirt.org/13091 To unsubscribe, visit http://gerrit.ovirt.org/settings Gerrit-MessageType: comment Gerrit-Change-Id: I7b7a6691f6cfa2ca1c0d0d90294ecd93781fce38 Gerrit-PatchSet: 3 Gerrit-Project: ovirt-engine Gerrit-Branch: master Gerrit-Owner: Ravi Nori <rn...@redhat.com> Gerrit-Reviewer: Michael Pasternak <mpast...@redhat.com> Gerrit-Reviewer: Oved Ourfali <oourf...@redhat.com> Gerrit-Reviewer: Ravi Nori <rn...@redhat.com> Gerrit-Reviewer: Yair Zaslavsky <yzasl...@redhat.com> _______________________________________________ Engine-patches mailing list Engine-patches@ovirt.org http://lists.ovirt.org/mailman/listinfo/engine-patches
