Domain - "View Templates" Button Does Not Filter

[scottsignal]

problem

Clicking on View Templates from Domain as Root Admin does not filter correctly.

Expecting to only see 2 templates:

versions

4.19.1.3 & 4.20.0.0
GUI
KVM

The steps to reproduce the bug

1. Logged in as Root Admin click on Domains
2. Choose a Sub-Domain (Note: this Sub-Domain should have its own templates)
3. Click on the View Templates Button
4. Observe the returned results are not for just that domain. There is no filtering done.

What to do about it?

While this is similar to #10391, I'm not sure on this one. ListTemplates seems to require an Account Name (Unless this is actually a bug as well). Simply adding &templatefilter=self does not fix this.

If ListTemplates really requires an account name, is this button needed?

[bernardodemarco]

@scottsignal, thanks for reporting the bug, I reproduced it in 4.19.

Simply adding &templatefilter=self does not fix this.

Yes, it seems to be an API bug. In my local environment, I created a domain ROOT/d1 and registered a template with an account belonging to that domain. However, when executing the listTemplates API through CloudMonkey, specifying the ROOT/d1 ID in the domainid field, all templates are returned:

(localcloud) 🐂 > list templates templatefilter=self domainid=e4484046-403c-41df-80ac-c21f760edaec filter=name,account,domain
{
  "count": 6,
  "template": [
    {
      "account": "admin",
      "domain": "ROOT",
      "name": "systemvm-kvm-4.19.1"
    },
    {
      "account": "admin",
      "domain": "ROOT",
      "name": "systemvm-kvm-4.20.0-x86_64"
    },
    {
      "account": "admin",
      "domain": "ROOT",
      "name": "Ubuntu 18.04"
    },
    {
      "account": "d1",
      "domain": "d1",
      "name": "Macchinina"
    },
    {
      "account": "system",
      "domain": "ROOT",
      "name": "SystemVM Template (KVM)"
    },
    {
      "account": "system",
      "domain": "ROOT",
      "name": "CentOS 5.5(64-bit) no GUI (KVM)"
    }
  ]
}

---

If ListTemplates really requires an account name, is this button needed?

I'm not entirely sure if the account field is required. If it were, the API docs, or the API response, would need to somehow inform it to the users. Therefore, it needs further investigation.

[DaanHoogland]

@bernardodemarco , did you execute the API as the account in ROOT/d1 ? As root admin I would expect all templates to be returned.

[bernardodemarco]

@bernardodemarco , did you execute the API as the account in ROOT/d1 ?

No, I executed it with a Root Admin account.

As root admin I would expect all templates to be returned.

Yes, I agree that Root Admins expect all templates to be returned. However, I also think that Root Admins should have the ability to filter templates by domain and account. The filtering by account currently is already achieved through the API; the UI does not support it (vide #10391). The filtering by domain is not supported neither through the UI, nor through the API (vide #10392 (comment)).

[DaanHoogland]

@bernardodemarco , I agree that filtering to suit the user should be possible auth permitting. I feared for a moment that we had a problem with authorisation, but root admin has god rights ;) . I do urge that the default remains the present show all behaviour. however, the redirection from the domains page may of course set a filter.