restapi: Remove sensitive response fields for non-admin users

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/AbstractBackendNetworkResource.java

@@ -3,6 +3,7 @@
 import javax.ws.rs.core.Response;
 
 import org.ovirt.engine.api.model.Network;
+import org.ovirt.engine.api.restapi.util.FieldCleaner;
 import org.ovirt.engine.core.common.action.ActionParametersBase;
 import org.ovirt.engine.core.common.action.ActionType;
 
@@ -29,6 +30,13 @@ public Network get() {
         return addLinks(map(entity));
     }
 
+    protected void removeRestrictedInfo(Network network) {
+        // Filtered users are not allowed to view restricted information
+        if (!isAdmin()) {
+            nullifyRestrictedFields(network);
+        }
+    }
+
     AbstractBackendNetworksResource getParent() {
         return parent;
     }
@@ -44,4 +52,9 @@ public Response remove() {
         }
         return performAction(removeAction, getRemoveParameters(entity));
     }
+
+    public static void nullifyRestrictedFields(Network network) {
+        FieldCleaner.nullifyAllFieldsExcept(network, "id", "name", "dataCenter");
+        FieldCleaner.nullifyAllFieldsExcept(network.getDataCenter(), "id");
+    }
 }

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/AbstractBackendNetworksResource.java

@@ -1,5 +1,7 @@
 package org.ovirt.engine.api.restapi.resource;
 
+import static org.ovirt.engine.api.restapi.resource.AbstractBackendNetworkResource.nullifyRestrictedFields;
+
 import java.util.List;
 
 import org.ovirt.engine.api.model.BaseResource;
@@ -31,6 +33,15 @@ public Networks list() {
         return mapCollection(getBackendCollection(queryType, getQueryParameters()));
     }
 
+    protected void removeRestrictedInfo(Networks networks) {
+        // Filtered users are not allowed to view restricted information
+        if (!isAdmin()) {
+            for (Network network : networks.getNetworks()) {
+                nullifyRestrictedFields(network);
+            }
+        }
+    }
+
     protected Networks mapCollection(List<org.ovirt.engine.core.common.businessentities.network.Network> entities) {
         Networks collection = new Networks();
         for (org.ovirt.engine.core.common.businessentities.network.Network entity : entities) {

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendClusterNetworkResource.java

@@ -26,7 +26,12 @@ public Network get() {
         if (entity == null) {
             return notFound();
         }
-        return addLinks(map(entity), Cluster.class);
+
+        Network network = map(entity);
+        network = addLinks(network, Cluster.class);
+        removeRestrictedInfo(network);
+
+        return network;
     }
 
     @Override

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendClusterNetworksResource.java

@@ -31,8 +31,10 @@ public BackendClusterNetworksResource(String clusterId) {
 
     @Override
     public Networks list() {
-        return mapCollection(getBackendCollection(queryType, getQueryParameters()),
+        Networks networks = mapCollection(getBackendCollection(queryType, getQueryParameters()),
                 org.ovirt.engine.api.model.Cluster.class);
+        removeRestrictedInfo(networks);
+        return networks;
     }
 
     @Override

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendDataCenterNetworkResource.java

@@ -27,7 +27,12 @@ public Network get() {
         if (entity == null) {
             return notFound();
         }
-        return addLinks(map(entity), LinkHelper.NO_PARENT);
+
+        Network network = map(entity);
+        network = addLinks(network, LinkHelper.NO_PARENT);
+        removeRestrictedInfo(network);
+
+        return network;
     }
 
     private org.ovirt.engine.core.common.businessentities.network.Network getNetwork() {

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendDataCenterNetworksResource.java

@@ -50,6 +50,7 @@ public Networks list() {
         for (Network network : networks.getNetworks()) {
             network.setDisplay(null);
         }
+        removeRestrictedInfo(networks);
         return networks;
     }
 

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendHostsResource.java

@@ -12,6 +12,7 @@
 import org.ovirt.engine.api.model.Hosts;
 import org.ovirt.engine.api.resource.HostResource;
 import org.ovirt.engine.api.resource.HostsResource;
+import org.ovirt.engine.api.restapi.util.FieldCleaner;
 import org.ovirt.engine.api.restapi.util.ParametersHelper;
 import org.ovirt.engine.core.common.action.ActionType;
 import org.ovirt.engine.core.common.action.VdsOperationActionParameters;
@@ -52,11 +53,16 @@ public BackendHostsResource() {
     @Override
     public Hosts list() {
         ApplicationMode appMode = getCurrent().getApplicationMode();
+
+        Hosts hosts;
         if (appMode == ApplicationMode.GlusterOnly) {
-            return listGlusterOnly();
+            hosts = listGlusterOnly();
         } else {
-            return listAll();
+            hosts = listAll();
         }
+        removeRestrictedInfo(hosts);
+
+        return hosts;
     }
 
     private Hosts listGlusterOnly() {
@@ -100,6 +106,16 @@ private Hosts listAll() {
         return mapCollection(getBackendCollection(SearchType.VDS));
     }
 
+    private void removeRestrictedInfo(Hosts hosts) {
+        // Filtered users are not allowed to view restricted information
+        if (!isAdmin()) {
+            for (Host host : hosts.getHosts()) {
+                FieldCleaner.nullifyAllFieldsExcept(host, "id", "name", "address", "cluster");
+                FieldCleaner.nullifyAllFieldsExcept(host.getCluster(), "id");
+            }
+        }
+    }
+
     @Override
     public HostResource getHostResource(String id) {
         return inject(new BackendHostResource(id, this));

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendIscsiBondNetworkResource.java

@@ -33,7 +33,11 @@ public Network get() {
             return notFound();
         }
 
-        return addLinks(map(entity), LinkHelper.NO_PARENT);
+        Network network = map(entity);
+        network = addLinks(network, LinkHelper.NO_PARENT);
+        removeRestrictedInfo(network);
+
+        return network;
     }
 
     private org.ovirt.engine.core.common.businessentities.network.Network getNetwork() {

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendIscsiBondNetworksResource.java

@@ -25,10 +25,12 @@ public BackendIscsiBondNetworksResource(String iscsiBondId) {
 
     @Override
     public Networks list() {
-        return mapCollection(
+        Networks networks = mapCollection(
                 getBackendCollection(QueryType.GetNetworksByIscsiBondId, new IdQueryParameters(iscsiBondId)),
                 LinkHelper.NO_PARENT
         );
+        removeRestrictedInfo(networks);
+        return networks;
     }
 
     @Override

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendNetworkResource.java

@@ -27,9 +27,13 @@ public Network get() {
         if (entity == null) {
             return notFound();
         }
+
         Network network = map(entity);
         network.setDisplay(null);
-        return addLinks(network, LinkHelper.NO_PARENT);
+        network = addLinks(network, LinkHelper.NO_PARENT);
+        removeRestrictedInfo(network);
+
+        return network;
     }
 
     @Override

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendNetworksResource.java

@@ -60,6 +60,8 @@ public Networks list() {
         for (Network network : networks.getNetworks()) {
             network.setDisplay(null);
         }
+        removeRestrictedInfo(networks);
+
         return networks;
     }
 

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendStorageDomainResource.java

@@ -32,6 +32,7 @@
 import org.ovirt.engine.api.resource.StorageDomainServerConnectionsResource;
 import org.ovirt.engine.api.resource.StorageDomainTemplatesResource;
 import org.ovirt.engine.api.resource.StorageDomainVmsResource;
+import org.ovirt.engine.api.restapi.util.FieldCleaner;
 import org.ovirt.engine.api.restapi.util.ParametersHelper;
 import org.ovirt.engine.api.restapi.util.StorageDomainHelper;
 import org.ovirt.engine.core.common.VdcObjectType;
@@ -77,7 +78,16 @@ BackendStorageDomainsResource getParent() {
     @Override
     public StorageDomain get() {
         StorageDomain storageDomain = performGet(QueryType.GetStorageDomainById, new IdQueryParameters(guid));
-        return addLinks(storageDomain, getLinksToExclude(storageDomain));
+        storageDomain = addLinks(storageDomain, getLinksToExclude(storageDomain));
+        removeRestrictedInfo(storageDomain);
+        return storageDomain;
+    }
+
+    private void removeRestrictedInfo(StorageDomain storageDomain) {
+        // Filtered users are not allowed to view restricted information
+        if (!isAdmin()) {
+            nullifyRestrictedFields(storageDomain);
+        }
     }
 
     @Override
@@ -238,6 +248,15 @@ public static synchronized String[] getLinksToExclude(StorageDomain storageDomai
                                 : new String[] { "files", "images" };
     }
 
+    public static void nullifyRestrictedFields(StorageDomain storageDomain) {
+        FieldCleaner.nullifyAllFieldsExcept(
+                storageDomain, "id", "name", "type", "permissions",
+                "storage", "available", "used", "status", "dataCenter", "links");
+        FieldCleaner.nullifyAllFieldsExcept(storageDomain.getStorage(), "type");
+        FieldCleaner.nullifyAllFieldsExcept(storageDomain.getDataCenter(), "id");
+        FieldCleaner.removeAllLinksExcept(storageDomain, "permissions");
+    }
+
     /**
      * if user added new LUNs - extend the storage domain.
      */

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BackendStorageDomainsResource.java

@@ -1,6 +1,7 @@
 package org.ovirt.engine.api.restapi.resource;
 
 import static org.ovirt.engine.api.restapi.resource.BackendStorageDomainResource.getLinksToExclude;
+import static org.ovirt.engine.api.restapi.resource.BackendStorageDomainResource.nullifyRestrictedFields;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -69,11 +70,23 @@ public BackendStorageDomainsResource() {
 
     @Override
     public StorageDomains list() {
+        StorageDomains storageDomains;
         if (isFiltered()) {
-            return mapCollection(getBackendCollection(QueryType.GetAllStorageDomains,
+            storageDomains = mapCollection(getBackendCollection(QueryType.GetAllStorageDomains,
                     new QueryParametersBase(), SearchType.StorageDomain));
         } else {
-            return mapCollection(getBackendCollection(SearchType.StorageDomain));
+            storageDomains = mapCollection(getBackendCollection(SearchType.StorageDomain));
+        }
+        removeRestrictedInfo(storageDomains);
+        return storageDomains;
+    }
+
+    private void removeRestrictedInfo(StorageDomains storageDomains) {
+        // Filtered users are not allowed to view restricted information
+        if (!isAdmin()) {
+            for (StorageDomain storageDomain : storageDomains.getStorageDomains()) {
+                nullifyRestrictedFields(storageDomain);
+            }
         }
     }
 

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BaseBackendResource.java

@@ -413,6 +413,14 @@ protected boolean isFiltered() {
         return result;
     }
 
+    /**
+     * @return true if current user has admin permission, otherwise false.
+     */
+    protected boolean isAdmin() {
+        DbUser user = getCurrent().getUser();
+        return user.isAdmin();
+    }
+
     /**
      * Follows links in the entity according to value of "follow" URL query parameter.
      * A valid value of'follow' is a comma separated list of strings, which represent

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/util/FieldCleaner.java

@@ -0,0 +1,52 @@
+package org.ovirt.engine.api.restapi.util;
+
+import java.lang.reflect.Field;
+import java.util.List;
+import java.util.Set;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.ovirt.engine.api.model.BaseResource;
+import org.ovirt.engine.api.model.Link;
+
+public class FieldCleaner {
+
+    private FieldCleaner() { }
+
+    public static void removeAllLinksExcept(BaseResource baseResource, String... allowedRel) {
+        List<Link> links = baseResource.getLinks();
+        if (CollectionUtils.isEmpty(links)) {
+            return;
+        }
+
+        Set<String> allowedRelSet = Set.of(allowedRel);
+        links.removeIf(link -> !allowedRelSet.contains(link.getRel()));
+    }
+
+    public static void nullifyAllFieldsExcept(Object obj, String... allowedFields) {
+        if (obj == null) {
+            return;
+        }
+
+        Set<String> allowedFieldSet = Set.of(allowedFields);
+        Class<?> currentClass = obj.getClass();
+        while (currentClass != null) {
+            for (Field field : currentClass.getDeclaredFields()) {
+                if (!allowedFieldSet.contains(field.getName())) {
+                    nullifyField(obj, field);
+                }
+            }
+            currentClass = currentClass.getSuperclass();
+        }
+    }
+
+    private static void nullifyField(Object obj, Field field) {
+        try {
+            field.setAccessible(true);
+            if (!field.getType().isPrimitive()) {
+                field.set(obj, null);
+            }
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to nullify field: " + field.getName(), e);
+        }
+    }
+}

backend/manager/modules/restapi/jaxrs/src/test/java/org/ovirt/engine/api/restapi/resource/AbstractBackendBaseTest.java

@@ -142,6 +142,7 @@ public void setUp() {
         currentUser.setLastName(USER);
         currentUser.setDomain(DOMAIN);
         currentUser.setNamespace(NAMESPACE);
+        currentUser.setAdmin(true);
         currentUser.setId(GUIDS[0]);
 
         Current current = new Current();