theforeman/foreman — pull request #1654 by ehelms (2014-08-05 23:41:44+00:00)
Title: Fixes #6777: Ensure associations respect organization boundaries.

Resources that contain a belongs to relationship to Organization
should only be associated to other resources that are within that
organization. Further, two resources that belong to different
organizations should not be allowed to be associated to one another.

This issue manifests itself among hosts and most Katello resources.
For hosts, resources that are not available in the hosts organization
should not be allowed to be associated to the host. In Katello,
resources are allowed to belong to a single organization and should
not be allowed to cross boundaries. For example, a product in organization
A should not be allowed to be associated with a GPG key in organization
B.

Finally, this solution takes the approach of validating the association
relationships at the model level to ensure no inconsistent data can
be created at any layer of the application.