attach iso succeeds from different zone

[DaanHoogland]

When attaching an iso from zone A to a stopped VM from zone B, a customer reported that the API succeeds. The VM can not be started as the ISO is not available in the required zone.
I have not reproduced the error for lack of being able to create a suitable environment, but code analysis shows that this is plausible.

the following fragment should ensure the attachement fails with a proper error result:

$ git diff
diff --git a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
index b81faeb0bd..9058b4922f 100755
--- a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
@@ -1182,6 +1182,12 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
             throw new InvalidParameterValueException("Unable to find a virtual machine with id " + vmId);
         }

+        long dcId = vm.getDataCenterId();
+        VMTemplateZoneVO exists = _tmpltZoneDao.findByZoneTemplate(dcId, isoId);
+        if (null == exists) {
+            throw new InvalidParameterValueException("iso is not available in the zone the VM is in.");
+        }
+
         VMTemplateVO iso = _tmpltDao.findById(isoId);
         if (iso == null || iso.getRemoved() != null) {
             throw new InvalidParameterValueException("Unable to find an ISO with id " + isoId);

ISSUE TYPE

( * Bug Report)

• Improvement Request

COMPONENT NAME

API

CLOUDSTACK VERSION

All

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

attaching an ISO from another zone succeeds when it should fail

STEPS TO REPRODUCE

create two zones
create a VM in zone 1
make sure the VM is stopped
register an ISO in the other zone
attach the ISO to the VM

EXPECTED RESULTS

ISO will not be attached

ACTUAL RESULTS

ISO is attached to the VM

[DaanHoogland]

the problem is not there in the UI. The ISO will not be shown when choosing to attach to a VM.

[DaanHoogland]

in cloud monkey however:

(localcloud) SBCM5> > attach iso id=f114169c-ab33-46b6-94a3-1976d97ac2e1 virtualmachineid=80501fe5-3b4b-49f6-9907-785972ea5a1c
{
  "virtualmachine": {
...
    "displayname": "VM-80501fe5-3b4b-49f6-9907-785972ea5a1c",
...
    "id": "80501fe5-3b4b-49f6-9907-785972ea5a1c",
    "instancename": "i-2-5-VM",
...
    "isodisplaytext": "tiny ISO",
    "isoid": "f114169c-ab33-46b6-94a3-1976d97ac2e1",
    "isoname": "tiny",
...
    "name": "VM-80501fe5-3b4b-49f6-9907-785972ea5a1c",
...
    **_"zoneid": "9baadf03-0945-4e90-8b4d-6faf5a10eff0",_**
    "zonename": "ref-trl-79-k-M7-dhoogland"
  }
}

(localcloud) SBCM5> > list isos
{
  "count": 1,
  "iso": [
    {
...
      "crossZones": false,
...
      "displaytext": "tiny ISO",
...
      "id": "f114169c-ab33-46b6-94a3-1976d97ac2e1",
...
      "name": "tiny",
...
      **_"zoneid": "6ee90895-209c-4ecb-8e07-4dec2c39ee1e",_**
      "zonename": "ref-trl-81-k-M7-dhoogland"
    }
  ]
}

[andrijapanicsb]

Fixed by #3755