CVE-2016-0721 (Ruby, published 2017-04-21T15:59Z)
Description: value: Session fixation vulnerability in pcsd in pcs before 0.9.157.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/ClusterLabs/pcs
Files changed:
pcsd/auth.rb
pcsd/cfgsync.rb
pcsd/cluster_entity.rb
pcsd/fenceagent.rb
pcsd/pcs.rb
pcsd/pcsd-cli.rb
pcsd/pcsd.rb
pcsd/remote.rb
pcsd/resource.rb
pcsd/test/test_auth.rb
Commit message: web UI auth: decouple auth_user from session

Sessions are processed in web UI part only. Pcsd backend does not work
with sessions so it only gets who is logged in and not the whole session.


Vulnerable code:
      getSuperuserSession, "id", "-Gn", username
  def self.loginByToken(session, cookies)
          session[:username] = cookies['CIB_user']
            session[:usergroups] = cookieUserDecode(
            session[:usergroups] = []
          session[:username] = SUPERUSER
          session[:usergroups] = []
        return true
        session[:username] = username
        session[:usergroups] = success ? groups : []
        return true
    return false
  def self.loginByPassword(session, username, password)
      session[:username] = username
      session[:usergroups] = success ? groups : []
      return true
    return false
  def self.getSuperuserSession()
    def initialize(session, configs, nodes, cluster_name, tokens={})
      @session = session
            @session, node, 'set_configs', true, data, true, nil, 30,
    def initialize(session, config_classes, nodes, cluster_name)
      @session = session
            @session, node, 'get_configs', false, data
        PCSAuth.getSuperuserSession(), [config], nodes, cluster_name, tokens
            PCSAuth.getSuperuserSession(), [config.class], nodes, cluster_name
      PCSAuth.getSuperuserSession(), [config_new], nodes, cluster_name,
      PCSAuth.getSuperuserSession(), [config_new.class], nodes, cluster_name
    def self.load_current_node(session, crm_dom=nil)
def getFenceAgents(session, fence_agent = nil)
      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(session, fa.name)
def getFenceAgentMetadata(session, fenceagentname)
    session, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
def getAllSettings(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def add_fence_level(session, level, devices, node, remove = false)
      session, PCS, "stonith", "level", "add", level, node, devices
      session, PCS, "stonith", "level", "remove", level, node, devices
def add_node_attr(session, node, key, value)
    session, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
def add_meta_attr(session, resource, key, value)
    session, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
  session, resource, node, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *cmd)
  session, resource, rule, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *cmd)
    session, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
  stdout, stderr, retval = run_cmd(session, *command)
  session, resource_set_list, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *command)
  session, resourceA, resourceB, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(session, *command)
def remove_constraint(session, constraint_id)
    session, PCS, "constraint", "remove", constraint_id
def remove_constraint_rule(session, rule_id)
    session, PCS, "constraint", "rule", "remove", rule_id
def add_acl_role(session, name, description)
  stdout, stderror, retval = run_cmd(session, *cmd)
def add_acl_permission(session, acl_role_id, perm_type, xpath_id, query_id)
    session, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
def add_acl_usergroup(session, acl_role_id, user_group, name)
      session, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
    session, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
def remove_acl_permission(session, acl_perm_id)
    session, PCS, "acl", "permission", "delete", acl_perm_id.to_s
def remove_acl_usergroup(session, role_id, usergroup_id)
    session, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
def send_cluster_request_with_token(session, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
    session, nodes, request, post, data, remote, raw_data
def send_nodes_request_with_token(session, nodes, request, post=false, data={}, remote=true, raw_data=nil)
      session, node, request, post, data, remote, raw_data
def send_request_with_token(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
    session, node, request, post, data, remote, raw_data, timeout, cookies_data
def send_request(session, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
      session[:username].to_s
      (session[:usergroups] || []).join(' ')
def add_node(session, new_nodename, all=false, auto_start=true)
    out, stderror, retval = run_cmd(session, *command)
      session, PCS, "cluster", "localnode", "add", new_nodename
def remove_node(session, new_nodename, all=false)
      session, PCS, "cluster", "node", "remove", new_nodename, "--force"
      session, PCS, "cluster", "localnode", "remove", new_nodename
    PCSAuth.getSuperuserSession, CRM_NODE, "-n"
      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster.cman"
      PCSAuth.getSuperuserSession,
    PCSAuth.getSuperuserSession,
    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "corosync"
    PCSAuth.getSuperuserSession, PCS, "status", "nodes", "both"
  out, errout, retval = run_cmd(PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL)
def get_resource_agents_avail(session)
    session, params[:cluster], 'get_avail_resource_agents'
def get_stonith_agents_avail(session)
    session, params[:cluster], 'get_avail_fence_agents'
      PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "cluster"
    PCSAuth.getSuperuserSession, COROSYNC_CMAPCTL, "totem.cluster_name"
def get_node_attributes(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def get_fence_levels(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def get_acls(session, cib_dom=nil)
    cib_dom = get_cib_dom(session)
def enable_cluster(session)
  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "enable")
def disable_cluster(session)
  stdout, stderror, retval = run_cmd(session, PCS, "cluster", "disable")
      PCSAuth.getSuperuserSession, COROSYNC, "-v"
      PCSAuth.getSuperuserSession, PACEMAKERD, "-$"
      PCSAuth.getSuperuserSession, CMAN_TOOL, "-V"
def run_cmd(session, *args)
  return run_cmd_options(session, options, *args)
def run_cmd_options(session, options, *args)
  cib_user = session[:username]
  cib_groups = (session[:usergroups] || []).join(' ')
def check_gui_status_of_nodes(session, nodes, check_mutuality=false, timeout=10)
        session, node, 'check_auth', false, options, true, nil, timeout
def pcs_auth(session, nodes, username, password, force=false, local=true)
      session, nodes, true
    session, nodes, nodes, username, password, force, true
        session, nodes_to_auth, nodes, username, password, force, false
def run_auth_requests(session, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
      code, response = send_request(session, node, 'auth', true, data)
  session, nodes, force=false, clear_local_permissions=false
    session, configs.values(), nodes, $cluster_name
def send_local_certs_to_nodes(session, nodes)
        session, node, '/set_certs', true, data
def pcsd_restart_nodes(session, nodes)
        session, node, '/pcsd_restart', true
    PCSAuth.getSuperuserSession(),
    PCSAuth.getSuperuserSession(),
def cluster_status_from_nodes(session, cluster_nodes, cluster_name)
        session,
def get_node_status(session, cib_dom)
      :acls => get_acls(session, cib_dom),
      :username => session[:username],
      :fence_levels => get_fence_levels(session, cib_dom),
      :node_attr => node_attrs_to_v2(get_node_attributes(session, cib_dom)),
  node_status[:cluster_settings] = getAllSettings(session, cib_dom)
def get_crm_mon_dom(session)
      session, CRM_MON, '--one-shot', '-r', '--as-xml'
def get_cib_dom(session)
    stdout, _, retval = run_cmd(session, 'cibadmin', '-Q', '-l')
def allowed_for_local_cluster(session, action)
    session[:username], session[:usergroups], action
def allowed_for_superuser(session)
    "permission check superuser username=#{session[:username]} groups=#{session[:groups]}"
  if SUPERUSER != session[:username]
session = {}
    session[:username] = ENV['CIB_user']
      session[:usergroups] = ENV['CIB_user_groups'].split(nil)
      session[:usergroups] = []
    session[:username] = SUPERUSER
    session[:usergroups] = []
    session[:username] = username
    session[:usergroups] = success ? groups : []
# continue environment setup with user set in session
    'call' => lambda { |params, session| read_tokens() },
    'call' => lambda { |params, session|
        session, params['nodes'] || [], params['username'] || '',
    'call' => lambda { |params, session|
        PCSAuth.getSuperuserSession(),
    'call' => lambda { |params, session|
      send_local_certs_to_nodes(session, params['nodes'] || [])
    'call' => lambda { |params, session|
      pcsd_restart_nodes(session, params['nodes'] || [])
    if not allowed_for_superuser(session)
    if not allowed_for_local_cluster(session, command_settings['permissions'])
  result = allowed_commands[command]['call'].call(params, session)
  @errorval = session[:errorval]
  @error = session[:error]
  session[:errorval] = nil
  session[:error] = nil
              PCSAuth.getSuperuserSession(), Cfgsync::get_cfg_classes(),
      unless PCSAuth.loginByToken(session, cookies)
  return remote(params, request, session)
  return remote(params, request, session)
    if not allowed_for_superuser(session)
    if not allowed_for_local_cluster(session, command_settings['permissions'])
    session, options, PCS, *command_decoded
    if PCSAuth.loginByPassword(session, params['username'], params['password'])
      PCSAuth.getSuperuserSession(), node, 'status'
        PCSAuth.getSuperuserSession(), node, '/get_cluster_tokens'
    if not allowed_for_superuser(session)
        session, n, "/save_tokens", true, tokens
      session,
        session, node_array
            session, node, 'get_sw_versions'
          rescue JSON::ParserError => e
          code, response = send_request(session, nodename, 'auth', true, data)
    clusters_overview(params, request, session)
        session, @cluster_name, 'get_permissions'
    @resource_agents = get_resource_agents_avail(session)
    @stonith_agents = get_stonith_agents_avail(session)
      session, params[:cluster], "set_permissions", true, new_params
    status_all(params, request, session, get_cluster_nodes(params[:cluster]))
    cluster_status_gui(session, params[:cluster])
    code, out = send_cluster_request_with_token(session, cluster, 'get_cib')
        session, cluster, 'get_cluster_properties_definition'
      PCSAuth.getSuperuserSession(), clustername, "/save_tokens", true,
      if not allowed_for_local_cluster(session, Permissions::FULL)
      PCSAuth.getSuperuserSession(), clustername, '/save_tokens', true, token_data
      session, clustername, "/add_node_all", true, params
        session, params[:cluster], request, true, params, true, raw_data
          session, params[:cluster], redirection[request], true, params, false,
        session, params[:cluster], "/" + params[:splat].join("/"), false, params,
        true, raw_data
def remote(params, request, session)
      :add_node_all => lambda { |params_, request_, session_|
        remote_add_node(params_, request_, session_, true)
      :add_node => lambda { |params_, request_, session_|
        remote_add_node(params_, request_, session_, false)
    return remote_cmd_without_pacemaker[command].call(params, request, session)
      return remote_cmd_with_pacemaker[command].call(params, request, session)
def cluster_status_gui(session, cluster_name, dont_update_config=false)
  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
      return cluster_status_gui(session, cluster_name, true)
def cluster_status_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  status = cluster_status_from_nodes(session, cluster_nodes, cluster_name)
def cluster_start(params, request, session)
      session, params[:name], 'cluster_start', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
def cluster_stop(params, request, session)
      session, params[:name], 'cluster_stop', true, params_without_name
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "stop", *options)
def config_backup(params, request, session)
      session, params[:name], 'config_backup', true
    if not allowed_for_local_cluster(session, Permissions::FULL)
    stdout, stderr, retval = run_cmd(session, PCS, "config", "backup")
def config_restore(params, request, session)
      session, params[:name], 'config_restore', true,
    if not allowed_for_local_cluster(session, Permissions::FULL)
def node_restart(params, request, session)
      session, params[:name], 'node_restart', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
def node_standby(params, request, session)
      session, params[:name], 'node_standby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "standby")
def node_unstandby(params, request, session)
      session, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, "cluster", "unstandby")
def cluster_enable(params, request, session)
      session, params[:name], 'cluster_enable', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    success = enable_cluster(session)
def cluster_disable(params, request, session)
      session, params[:name], 'cluster_disable', true
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    success = disable_cluster(session)
def get_quorum_info(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
      PCSAuth.getSuperuserSession, CMAN_TOOL, "status"
      PCSAuth.getSuperuserSession,
      PCSAuth.getSuperuserSession, COROSYNC_QUORUMTOOL, "-p", "-s"
def get_cib(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib, stderr, retval = run_cmd(session, CIBADMIN, "-Ql")
def get_corosync_conf_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
def set_cluster_conf(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_corosync_conf(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_sync_capabilities(params, request, session)
def set_sync_options(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_configs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_configs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def set_certs(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_permissions_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
def set_permissions_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
    if not allowed_for_local_cluster(session, Permissions::FULL)
def remote_pcsd_restart(params, request, session)
def get_sw_versions(params, request, session)
def remote_node_available(params, request, session)
def remote_add_node(params, request, session, all=false)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    retval, output = add_node(session, node, all, auto_start)
def remote_remove_nodes(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    session, PCS, "cluster", "stop", *stop_params
    retval, output = remove_node(session, node, true)
def remote_remove_node(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
    retval, output = remove_node(session, params[:remove_nodename])
def setup_cluster(params, request, session)
  if not allowed_for_superuser(session)
    session, PCS, "cluster", "setup", "--enable", "--start",
def create_cluster(params, request, session)
  if not allowed_for_superuser(session)
  if set_corosync_conf(params, request, session)
    cluster_start(params, request, session)
def node_status(params, request, session)
      session,
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib_dom = get_cib_dom(session)
  crm_dom = get_crm_mon_dom(session)
  status = get_node_status(session, cib_dom)
  node = ClusterEntity::Node.load_current_node(session, crm_dom)
    session,
def status_all(params, request, session, nodes=[], dont_update_config=false)
      code, response = send_request_with_token(session, node, 'status')
      return status_all(params, request, session, node_list, true)
def clusters_overview(params, request, session)
        session,
          session, node, 'cluster_status', true, {}, true, nil, 8
def auth(params, request, session)
        session, node_list, params['username'], params['password'],
def check_auth(params, request, session)
def resource_status(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @resources,@groups = getResourcesGroups(session)
def resource_stop(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "disable", params[:resource]
def resource_cleanup(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "cleanup", params[:resource]
def resource_start(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "enable", params[:resource]
def resource_form(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  cib_dom = get_cib_dom(session)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
def fence_device_form(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(session))
    @resource_agents = getFenceAgents(session, @cur_resource.agentname)
def update_resource (params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
        session,
      run_cmd(session, PCS, "resource", "clone", name)
      run_cmd(session, PCS, "resource", "master", name)
      session, PCS, "resource", "update", params[:resource_id], *param_line
          session, PCS, "resource", "group", "remove",
        session, PCS, "resource", "group", "add", params[:resource_group],
    run_cmd(session, PCS, "resource", "clone", params[:resource_id])
    run_cmd(session, PCS, "resource", "master", params[:resource_id])
      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
      session, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
def update_fence_device(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
      session, PCS, "stonith", "update", params[:resource_id], *param_line
def get_avail_resource_agents(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  agents = getResourceAgents(session)
def get_avail_fence_agents(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  agents = getFenceAgents(session)
def resource_metadata(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + resource_name + '.xml')
  @resources, @groups = getResourcesGroups(session)
def fence_device_metadata(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(session, params[:resourcename])
def remove_resource(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      out, errout, retval = run_cmd(session, *command)
def add_fence_level_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["level"], params["devices"], params["node"], params["remove"]
def add_node_attr_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["node"], params["key"], params["value"]
def add_acl_role_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
  retval = add_acl_role(session, params["name"], params["description"])
def remove_acl_roles_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
        session, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
def add_acl_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
      session,
      session, params["role_id"], params["item"], params["usergroup"]
def remove_acl_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::GRANT)
    retval = remove_acl_permission(session, params["acl_perm_id"])
      session, params["role_id"],params["usergroup_id"]
def add_meta_attr_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, params["res_id"], params["key"],params["value"]
def add_constraint_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
      session,
      session,
def add_constraint_rule_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
def add_constraint_set_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
      session,
def remove_constraint_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    retval = remove_constraint(session, params[:constraint_id])
def remove_constraint_rule_remote(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    retval = remove_constraint_rule(session, params[:rule_id])
def add_group(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, "resource", "group", "add", rg, *(resources.split(" "))
def update_cluster_settings(params, request, session)
  current = getAllSettings(session)
    if not allowed_for_local_cluster(session, Permissions::GRANT)
    if not allowed_for_local_cluster(session, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(session, PCS, 'property', 'set', *cmd_args)
def cluster_destroy(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
  out, errout, retval = run_cmd(session, PCS, "cluster", "destroy")
def get_wizard(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
def wizard_submit(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
def get_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def get_cluster_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def save_tokens(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::FULL)
def resource_master(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'master', params[:resource_id]
def resource_change_group(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
        session, PCS, 'resource', 'group', 'remove', params[:old_group_id],
    session,
def resource_ungroup(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'ungroup', params[:group_id]
def resource_clone(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'clone', params[:resource_id]
def resource_unclone(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'unclone', params[:resource_id]
def set_resource_utilization(params, reqest, session)
  unless allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
def set_node_utilization(params, reqest, session)
  unless allowed_for_local_cluster(session, Permissions::WRITE)
    session, PCS, 'node', 'utilization', node, "#{name}=#{value}"
def get_cluster_properties_definition(params, request, session)
  unless allowed_for_local_cluster(session, Permissions::READ)
    session, PCS, 'property', 'get_cluster_properties_definition'
def getResourcesGroups(session, get_fence_devices = false, get_all_options = false,
    session, CRM_MON, "--one-shot", "-r", "--as-xml"
    stdout, stderror, retval = run_cmd(session, "cibadmin", "-Q", "-l")
def getResourceMetadata(session, resourcepath)
    stdout, stderr, retval = run_cmd(session, resourcepath, 'meta-data')
def getResourceAgents(session)
  stdout, stderr, retval = run_cmd(session, PCS, "resource", "list", "--nodesc")
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(false, result)
    assert_equal({}, session)
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session
    session = {}
    result = PCSAuth.loginByToken(session, cookies)
    assert_equal(true, result)
      session

Fixed code:
      getSuperuserAuth(), "id", "-Gn", username
  def self.loginByToken(cookies)
    auth_user = {}
          auth_user[:username] = cookies['CIB_user']
            auth_user[:usergroups] = cookieUserDecode(
            auth_user[:usergroups] = []
          auth_user[:username] = SUPERUSER
          auth_user[:usergroups] = []
        return auth_user
        auth_user[:username] = username
        auth_user[:usergroups] = success ? groups : []
        return auth_user
    return nil
  def self.loginByPassword(username, password)
      auth_user = {}
      auth_user[:username] = username
      auth_user[:usergroups] = success ? groups : []
      return auth_user
    return nil
  def self.getSuperuserAuth()

  def self.sessionToAuthUser(session)
    return {
      :username => session[:username],
      :usergroups => session[:usergroups],
    }
  end

  def self.authUserToSession(auth_user, session)
    session[:username] = auth_user[:username]
    session[:usergroups] = auth_user[:usergroups]
  end
    def initialize(auth_user, configs, nodes, cluster_name, tokens={})
      @auth_user = auth_user
            @auth_user, node, 'set_configs', true, data, true, nil, 30,
    def initialize(auth_user, config_classes, nodes, cluster_name)
      @auth_user = auth_user
            @auth_user, node, 'get_configs', false, data
        PCSAuth.getSuperuserAuth(), [config], nodes, cluster_name, tokens
            PCSAuth.getSuperuserAuth(), [config.class], nodes, cluster_name
      PCSAuth.getSuperuserAuth(), [config_new], nodes, cluster_name,
      PCSAuth.getSuperuserAuth(), [config_new.class], nodes, cluster_name
    def self.load_current_node(crm_dom=nil)
def getFenceAgents(auth_user, fence_agent = nil)
      required_options, optional_options, advanced_options, info = getFenceAgentMetadata(auth_user, fa.name)
def getFenceAgentMetadata(auth_user, fenceagentname)
    auth_user, "/usr/sbin/#{fenceagentname}", '-o', 'metadata'
def getAllSettings(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def add_fence_level(auth_user, level, devices, node, remove = false)
      auth_user, PCS, "stonith", "level", "add", level, node, devices
      auth_user, PCS, "stonith", "level", "remove", level, node, devices
def add_node_attr(auth_user, node, key, value)
    auth_user, PCS, "property", "set", "--node", node, key.to_s + '=' + value.to_s
def add_meta_attr(auth_user, resource, key, value)
    auth_user, PCS, "resource", "meta", resource, key.to_s + "=" + value.to_s
  auth_user, resource, node, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *cmd)
  auth_user, resource, rule, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *cmd)
    auth_user, resourceA, resourceB, actionA, actionB, score, symmetrical=true,
  stdout, stderr, retval = run_cmd(auth_user, *command)
  auth_user, resource_set_list, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *command)
  auth_user, resourceA, resourceB, score, force=false, autocorrect=true
  stdout, stderr, retval = run_cmd(auth_user, *command)
def remove_constraint(auth_user, constraint_id)
    auth_user, PCS, "constraint", "remove", constraint_id
def remove_constraint_rule(auth_user, rule_id)
    auth_user, PCS, "constraint", "rule", "remove", rule_id
def add_acl_role(auth_user, name, description)
  stdout, stderror, retval = run_cmd(auth_user, *cmd)
def add_acl_permission(auth_user, acl_role_id, perm_type, xpath_id, query_id)
    auth_user, PCS, "acl", "permission", "add", acl_role_id.to_s, perm_type.to_s,
def add_acl_usergroup(auth_user, acl_role_id, user_group, name)
      auth_user, PCS, "acl", user_group, "create", name.to_s, acl_role_id.to_s
    auth_user, PCS, "acl", "role", "assign", acl_role_id.to_s, name.to_s
def remove_acl_permission(auth_user, acl_perm_id)
    auth_user, PCS, "acl", "permission", "delete", acl_perm_id.to_s
def remove_acl_usergroup(auth_user, role_id, usergroup_id)
    auth_user, PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s,
def send_cluster_request_with_token(auth_user, cluster_name, request, post=false, data={}, remote=true, raw_data=nil)
    auth_user, nodes, request, post, data, remote, raw_data
def send_nodes_request_with_token(auth_user, nodes, request, post=false, data={}, remote=true, raw_data=nil)
      auth_user, node, request, post, data, remote, raw_data
def send_request_with_token(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, additional_tokens={})
    auth_user, node, request, post, data, remote, raw_data, timeout, cookies_data
def send_request(auth_user, node, request, post=false, data={}, remote=true, raw_data=nil, timeout=30, cookies_data=nil)
      auth_user[:username].to_s
      (auth_user[:usergroups] || []).join(' ')
def add_node(auth_user, new_nodename, all=false, auto_start=true)
    out, stderror, retval = run_cmd(auth_user, *command)
      auth_user, PCS, "cluster", "localnode", "add", new_nodename
def remove_node(auth_user, new_nodename, all=false)
      auth_user, PCS, "cluster", "node", "remove", new_nodename, "--force"
      auth_user, PCS, "cluster", "localnode", "remove", new_nodename
    PCSAuth.getSuperuserAuth(), CRM_NODE, "-n"
      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster.cman"
      PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "corosync"
    PCSAuth.getSuperuserAuth(), PCS, "status", "nodes", "both"
  out, errout, retval = run_cmd(PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL)
def get_resource_agents_avail(auth_user, params)
    auth_user, params[:cluster], 'get_avail_resource_agents'
def get_stonith_agents_avail(auth_user, params)
    auth_user, params[:cluster], 'get_avail_fence_agents'
      PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "cluster"
    PCSAuth.getSuperuserAuth(), COROSYNC_CMAPCTL, "totem.cluster_name"
def get_node_attributes(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def get_fence_levels(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def get_acls(auth_user, cib_dom=nil)
    cib_dom = get_cib_dom(auth_user)
def enable_cluster(auth_user)
  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "enable")
def disable_cluster(auth_user)
  stdout, stderror, retval = run_cmd(auth_user, PCS, "cluster", "disable")
      PCSAuth.getSuperuserAuth(), COROSYNC, "-v"
      PCSAuth.getSuperuserAuth(), PACEMAKERD, "-$"
      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "-V"
def run_cmd(auth_user, *args)
  return run_cmd_options(auth_user, options, *args)
def run_cmd_options(auth_user, options, *args)
  cib_user = auth_user[:username]
  cib_groups = (auth_user[:usergroups] || []).join(' ')
def check_gui_status_of_nodes(auth_user, nodes, check_mutuality=false, timeout=10)
        auth_user, node, 'check_auth', false, options, true, nil, timeout
def pcs_auth(auth_user, nodes, username, password, force=false, local=true)
      auth_user, nodes, true
    auth_user, nodes, nodes, username, password, force, true
        auth_user, nodes_to_auth, nodes, username, password, force, false
def run_auth_requests(auth_user, nodes_to_send, nodes_to_auth, username, password, force=false, local=true)
      code, response = send_request(auth_user, node, 'auth', true, data)
  auth_user, nodes, force=false, clear_local_permissions=false
    auth_user, configs.values(), nodes, $cluster_name
def send_local_certs_to_nodes(auth_user, nodes)
        auth_user, node, '/set_certs', true, data
def pcsd_restart_nodes(auth_user, nodes)
        auth_user, node, '/pcsd_restart', true
    PCSAuth.getSuperuserAuth(),
    PCSAuth.getSuperuserAuth(),
def cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
        auth_user,
def get_node_status(auth_user, cib_dom)
      :acls => get_acls(auth_user, cib_dom),
      :username => auth_user[:username],
      :fence_levels => get_fence_levels(auth_user, cib_dom),
      :node_attr => node_attrs_to_v2(get_node_attributes(auth_user, cib_dom)),
  node_status[:cluster_settings] = getAllSettings(auth_user, cib_dom)
def get_crm_mon_dom(auth_user)
      auth_user, CRM_MON, '--one-shot', '-r', '--as-xml'
def get_cib_dom(auth_user)
    stdout, _, retval = run_cmd(auth_user, 'cibadmin', '-Q', '-l')
def allowed_for_local_cluster(auth_user, action)
    auth_user[:username], auth_user[:usergroups], action
def allowed_for_superuser(auth_user)
    "permission check superuser username=#{auth_user[:username]} groups=#{auth_user[:usergroups]}"
  if SUPERUSER != auth_user[:username]
auth_user = {}
    auth_user[:username] = ENV['CIB_user']
      auth_user[:usergroups] = ENV['CIB_user_groups'].split(nil)
      auth_user[:usergroups] = []
    auth_user[:username] = SUPERUSER
    auth_user[:usergroups] = []
    auth_user[:username] = username
    auth_user[:usergroups] = success ? groups : []
# continue environment setup with user set in auth_user
    'call' => lambda { |params, auth_user_| read_tokens() },
    'call' => lambda { |params, auth_user_|
        auth_user_, params['nodes'] || [], params['username'] || '',
    'call' => lambda { |params, auth_user_|
        PCSAuth.getSuperuserAuth(),
    'call' => lambda { |params, auth_user_|
      send_local_certs_to_nodes(auth_user_, params['nodes'] || [])
    'call' => lambda { |params, auth_user_|
      pcsd_restart_nodes(auth_user_, params['nodes'] || [])
    if not allowed_for_superuser(auth_user)
    if not allowed_for_local_cluster(auth_user, command_settings['permissions'])
  result = allowed_commands[command]['call'].call(params, auth_user)
  @auth_user = nil
              PCSAuth.getSuperuserAuth(), Cfgsync::get_cfg_classes(),
      @auth_user = PCSAuth.loginByToken(cookies)
      unless @auth_user
  return remote(params, request, @auth_user)
  return remote(params, request, @auth_user)
    if not allowed_for_superuser(@auth_user)
    if not allowed_for_local_cluster(@auth_user, command_settings['permissions'])
    @auth_user, options, PCS, *command_decoded
    auth_user = PCSAuth.loginByPassword(
      params['username'], params['password']
    )
    if auth_user
      PCSAuth.authUserToSession(auth_user, session)
      PCSAuth.getSuperuserAuth(), node, 'status'
        PCSAuth.getSuperuserAuth(), node, '/get_cluster_tokens'
    auth_user = PCSAuth.sessionToAuthUser(session)
    if not allowed_for_superuser(auth_user)
        auth_user, n, "/save_tokens", true, tokens
      auth_user,
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, node_array
    auth_user = PCSAuth.sessionToAuthUser(session)
            auth_user, node, 'get_sw_versions'
          rescue JSON::ParserError
    auth_user = PCSAuth.sessionToAuthUser(session)
          code, response = send_request(auth_user, nodename, 'auth', true, data)
    clusters_overview(params, request, PCSAuth.sessionToAuthUser(session))
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, @cluster_name, 'get_permissions'
    auth_user = PCSAuth.sessionToAuthUser(session)
    @resource_agents = get_resource_agents_avail(auth_user, params)
    @stonith_agents = get_stonith_agents_avail(auth_user, params)
    auth_user = PCSAuth.sessionToAuthUser(session)
      auth_user, params[:cluster], "set_permissions", true, new_params
    auth_user = PCSAuth.sessionToAuthUser(session)
    status_all(params, request, auth_user, get_cluster_nodes(params[:cluster]))
    auth_user = PCSAuth.sessionToAuthUser(session)
    cluster_status_gui(auth_user, params[:cluster])
    auth_user = PCSAuth.sessionToAuthUser(session)
    code, out = send_cluster_request_with_token(auth_user, cluster, 'get_cib')
        auth_user, cluster, 'get_cluster_properties_definition'
      PCSAuth.getSuperuserAuth(), clustername, "/save_tokens", true,
    auth_user = PCSAuth.sessionToAuthUser(session)
      if not allowed_for_local_cluster(auth_user, Permissions::FULL)
      PCSAuth.getSuperuserAuth(), clustername, '/save_tokens', true, token_data
      auth_user, clustername, "/add_node_all", true, params
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user, params[:cluster], request, true, params, true, raw_data
          auth_user,
          params[:cluster],
          redirection[request],
          true,
          params,
          false,
    auth_user = PCSAuth.sessionToAuthUser(session)
        auth_user,
        params[:cluster],
        "/" + params[:splat].join("/"),
        false,
        params,
        true,
        raw_data
def remote(params, request, auth_user)
      :add_node_all => lambda { |params_, request_, auth_user_|
        remote_add_node(params_, request_, auth_user_, true)
      :add_node => lambda { |params_, request_, auth_user_|
        remote_add_node(params_, request_, auth_user_, false)
    return remote_cmd_without_pacemaker[command].call(
      params, request, auth_user
    )
      return remote_cmd_with_pacemaker[command].call(params, request, auth_user)
def cluster_status_gui(auth_user, cluster_name, dont_update_config=false)
  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
      return cluster_status_gui(auth_user, cluster_name, true)
def cluster_status_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  status = cluster_status_from_nodes(auth_user, cluster_nodes, cluster_name)
def cluster_start(params, request, auth_user)
      auth_user, params[:name], 'cluster_start', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def cluster_stop(params, request, auth_user)
      auth_user, params[:name], 'cluster_stop', true, params_without_name
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(
      auth_user, PCS, "cluster", "stop", *options
    )
def config_backup(params, request, auth_user)
      auth_user, params[:name], 'config_backup', true
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "config", "backup")
def config_restore(params, request, auth_user)
      auth_user, params[:name], 'config_restore', true,
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def node_restart(params, request, auth_user)
      auth_user, params[:name], 'node_restart', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def node_standby(params, request, auth_user)
      auth_user, params[:name], 'node_standby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "standby")
def node_unstandby(params, request, auth_user)
      auth_user, params[:name], 'node_unstandby', true, {"node"=>params[:name]}
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(auth_user, PCS, "cluster", "unstandby")
def cluster_enable(params, request, auth_user)
      auth_user, params[:name], 'cluster_enable', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    success = enable_cluster(auth_user)
def cluster_disable(params, request, auth_user)
      auth_user, params[:name], 'cluster_disable', true
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    success = disable_cluster(auth_user)
def get_quorum_info(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
      PCSAuth.getSuperuserAuth(), CMAN_TOOL, "status"
      PCSAuth.getSuperuserAuth(),
      PCSAuth.getSuperuserAuth(), COROSYNC_QUORUMTOOL, "-p", "-s"
def get_cib(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib, stderr, retval = run_cmd(auth_user, CIBADMIN, "-Ql")
def get_corosync_conf_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
def set_cluster_conf(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_corosync_conf(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_sync_capabilities(params, request, auth_user)
def set_sync_options(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_configs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_configs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def set_certs(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_permissions_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
def set_permissions_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def remote_pcsd_restart(params, request, auth_user)
def get_sw_versions(params, request, auth_user)
def remote_node_available(params, request, auth_user)
def remote_add_node(params, request, auth_user, all=false)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    retval, output = add_node(auth_user, node, all, auto_start)
def remote_remove_nodes(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    auth_user, PCS, "cluster", "stop", *stop_params
    retval, output = remove_node(auth_user, node, true)
def remote_remove_node(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
    retval, output = remove_node(auth_user, params[:remove_nodename])
def setup_cluster(params, request, auth_user)
  if not allowed_for_superuser(auth_user)
    auth_user, PCS, "cluster", "setup", "--enable", "--start",
def create_cluster(params, request, auth_user)
  if not allowed_for_superuser(auth_user)
  if set_corosync_conf(params, request, auth_user)
    cluster_start(params, request, auth_user)
def node_status(params, request, auth_user)
      auth_user,
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib_dom = get_cib_dom(auth_user)
  crm_dom = get_crm_mon_dom(auth_user)
  status = get_node_status(auth_user, cib_dom)
  node = ClusterEntity::Node.load_current_node(crm_dom)
    auth_user,
def status_all(params, request, auth_user, nodes=[], dont_update_config=false)
      code, response = send_request_with_token(auth_user, node, 'status')
      return status_all(params, request, auth_user, node_list, true)
def clusters_overview(params, request, auth_user)
        auth_user,
          auth_user, node, 'cluster_status', true, {}, true, nil, 8
def auth(params, request, auth_user)
        auth_user, node_list, params['username'], params['password'],
def check_auth(params, request, auth_user)
def resource_status(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @resources,@groups = getResourcesGroups(auth_user)
def resource_stop(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "disable", params[:resource]
def resource_cleanup(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "cleanup", params[:resource]
def resource_start(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "enable", params[:resource]
def resource_form(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  cib_dom = get_cib_dom(auth_user)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + @cur_resource.type)
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
def fence_device_form(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @cur_resource = get_resource_by_id(params[:resource], get_cib_dom(auth_user))
    @resource_agents = getFenceAgents(auth_user, @cur_resource.agentname)
def update_resource (params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
        auth_user,
      run_cmd(auth_user, PCS, "resource", "clone", name)
      run_cmd(auth_user, PCS, "resource", "master", name)
      auth_user, PCS, "resource", "update", params[:resource_id], *param_line
          auth_user, PCS, "resource", "group", "remove",
        auth_user, PCS, "resource", "group", "add", params[:resource_group],
    run_cmd(auth_user, PCS, "resource", "clone", params[:resource_id])
    run_cmd(auth_user, PCS, "resource", "master", params[:resource_id])
      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
      auth_user, PCS, "resource", "unclone", params[:resource_id].sub(/:.*/,'')
def update_fence_device(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
      auth_user, PCS, "stonith", "update", params[:resource_id], *param_line
def get_avail_resource_agents(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  agents = getResourceAgents(auth_user)
def get_avail_fence_agents(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  agents = getFenceAgents(auth_user)
def resource_metadata(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, HEARTBEAT_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, PACEMAKER_AGENTS_DIR + resource_name)
    @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(auth_user, NAGIOS_METADATA_DIR + resource_name + '.xml')
  @resources, @groups = getResourcesGroups(auth_user)
def fence_device_metadata(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
  @fenceagent.required_options, @fenceagent.optional_options, @fenceagent.advanced_options, @fenceagent.info = getFenceAgentMetadata(auth_user, params[:resourcename])
def remove_resource(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      out, errout, retval = run_cmd(auth_user, *command)
def add_fence_level_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["level"], params["devices"], params["node"], params["remove"]
def add_node_attr_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["node"], params["key"], params["value"]
def add_acl_role_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
  retval = add_acl_role(auth_user, params["name"], params["description"])
def remove_acl_roles_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
        auth_user, PCS, "acl", "role", "delete", value.to_s, "--autodelete"
def add_acl_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
      auth_user,
      auth_user, params["role_id"], params["item"], params["usergroup"]
def remove_acl_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    retval = remove_acl_permission(auth_user, params["acl_perm_id"])
      auth_user, params["role_id"],params["usergroup_id"]
def add_meta_attr_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, params["res_id"], params["key"],params["value"]
def add_constraint_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
      auth_user,
      auth_user,
def add_constraint_rule_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
def add_constraint_set_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
      auth_user,
def remove_constraint_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    retval = remove_constraint(auth_user, params[:constraint_id])
def remove_constraint_rule_remote(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    retval = remove_constraint_rule(auth_user, params[:rule_id])
def add_group(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, "resource", "group", "add", rg, *(resources.split(" "))
def update_cluster_settings(params, request, auth_user)
  current = getAllSettings(auth_user)
    if not allowed_for_local_cluster(auth_user, Permissions::GRANT)
    if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    stdout, stderr, retval = run_cmd(
      auth_user, PCS, 'property', 'set', *cmd_args
    )
def cluster_destroy(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
  out, errout, retval = run_cmd(auth_user, PCS, "cluster", "destroy")
def get_wizard(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::READ)
def wizard_submit(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
def get_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def get_cluster_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def save_tokens(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::FULL)
def resource_master(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'master', params[:resource_id]
def resource_change_group(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
        auth_user, PCS, 'resource', 'group', 'remove', params[:old_group_id],
    auth_user,
def resource_ungroup(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'ungroup', params[:group_id]
def resource_clone(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'clone', params[:resource_id]
def resource_unclone(params, request, auth_user)
  if not allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'unclone', params[:resource_id]
def set_resource_utilization(params, reqest, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'resource', 'utilization', res_id, "#{name}=#{value}"
def set_node_utilization(params, reqest, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::WRITE)
    auth_user, PCS, 'node', 'utilization', node, "#{name}=#{value}"
def get_cluster_properties_definition(params, request, auth_user)
  unless allowed_for_local_cluster(auth_user, Permissions::READ)
    auth_user, PCS, 'property', 'get_cluster_properties_definition'
def getResourcesGroups(auth_user, get_fence_devices = false, get_all_options = false,
    auth_user, CRM_MON, "--one-shot", "-r", "--as-xml"
    stdout, stderror, retval = run_cmd(auth_user, "cibadmin", "-Q", "-l")
def getResourceMetadata(auth_user, resourcepath)
    stdout, stderr, retval = run_cmd(auth_user, resourcepath, 'meta-data')
def getResourceAgents(auth_user)
  stdout, stderr, retval = run_cmd(
    auth_user, PCS, "resource", "list", "--nodesc"
  )
    result = PCSAuth.loginByToken(cookies)
    assert_equal(nil, result)
    result = PCSAuth.loginByToken(cookies)
    assert_equal(nil, result)
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result
    result = PCSAuth.loginByToken(cookies)
      result