Security Audit

[open-cloud]

Security Audit

[tmack-pl]

I reviewed the can_update() method all models to ensure we are enforcing write permissions as described in the "Access Control" section of OpenCloud guide: http://open-cloud.github.io/0_overview/

Most of the changes are contained in these commits:
62807a0
60deb5a

There were some inconsistencies that needed to be fixed. I also refactored the permission checking business rules and moved them the user model. Every model still has a can_update(user) method, but instead of containing business rules object.can_update(user) just calls user.can_update_object(object). Moving the business rules out of the various object.can_update() and moving them into the user model helped eliminate redundant and inconsistent code form our object models.

I'm in the process of writing regression tests to check object write permissions. Once this is done I plan to create a script that builds a docker container and runs the tests inside the container, allowing us to quickly and easily verify our object write permissions for future builds. I hope to get this integrated into the jenkins build job.