diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 916addc75e9..93d96a18984 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -332,7 +332,7 @@ def render_chart rpt.generate_table(:userid => session[:userid]) else rpt = if session[:report_result_id] - MiqReportResult.for_user(current_user).find(session[:report_result_id]).report_results + MiqReportResult.find(session[:report_result_id]).report_results elsif session[:rpt_task_id].present? MiqTask.find(session[:rpt_task_id]).task_results else @@ -578,7 +578,12 @@ def report_only end # Dashboard widget will send in report result id else, find report result in the sandbox search_id = params[:rr_id] ? params[:rr_id].to_i : @sb[:pages][:rr_id] - rr = MiqReportResult.for_user(current_user).find(search_id) + rr = MiqReportResult.find(search_id) + unless rr.available_to_user?(current_user) + add_flash(_("Current user does not permission to view report data id: #{search_id}"), :error) + render :partial => "layouts/flash_msg" + return + end session[:report_result_id] = rr.id # Save report result id for chart rendering session[:rpt_task_id] = nil # Clear out report task id, using a saved report diff --git a/app/controllers/application_controller/report_downloads.rb b/app/controllers/application_controller/report_downloads.rb index 126acf59c4c..803b944d7e9 100644 --- a/app/controllers/application_controller/report_downloads.rb +++ b/app/controllers/application_controller/report_downloads.rb @@ -30,7 +30,7 @@ def render_pdf(report = nil) # Use rr frorm paging, if present rr ||= MiqReportResult.for_user(current_user).find(@sb[:pages][:rr_id]) if @sb[:pages] # Use report_result_id in session, if present - rr ||= MiqReportResult.for_user(current_user).find(session[:report_result_id]) if session[:report_result_id] + rr ||= MiqReportResult.find(session[:report_result_id]) if session[:report_result_id] filename = filename_timestamp(rr.report.title) disable_client_cache @@ -51,7 +51,7 @@ def render_report_data unless params[:task_id] # First time thru, kick off the report generate task if render_type @sb[:render_type] = render_type - rr = MiqReportResult.for_user(current_user).find(session[:report_result_id]) # Get report task id from the session + rr = MiqReportResult.find(session[:report_result_id]) # Get report task id from the session task_id = rr.async_generate_result(@sb[:render_type], :userid => session[:userid], :session_id => request.session_options[:id]) initiate_wait_for_task(:task_id => task_id) @@ -134,7 +134,7 @@ def report_for_rendering miq_task = MiqTask.find(session[:rpt_task_id]) miq_task.task_results elsif session[:report_result_id] - rr = MiqReportResult.for_user(current_user).find(session[:report_result_id]) + rr = MiqReportResult.find(session[:report_result_id]) report = rr.report_results report.report_run_time = rr.last_run_on report