Fix Unauthorised template/ISO list access to the domain/resource admins

In Apache CloudStack, while using the listTemplates and listIsos APIs, Domain Admins and Resource Admins can retrieve templates and ISOs outside their authorized scope when specifying the domainid parameter and the self or selfexecutable values in filter parameter. This results in unintended leakage of information related to those templates and ISOs. However, this issue does not affect accounts of the type User.

Co-authored-by: bernardodemarco <bernardomg2004@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

Author: 2 people

server/src/main/java/com/cloud/api/query/QueryManagerImpl.java

@@ -4572,7 +4572,7 @@ else if (!template.isPublicTemplate() && caller.getType() != Account.Type.ADMIN)
             if (!permittedAccounts.isEmpty()) {
                 domain = _domainDao.findById(permittedAccounts.get(0).getDomainId());
             } else {
-                domain = _domainDao.findById(Domain.ROOT_DOMAIN);
+                domain = _domainDao.findById(caller.getDomainId());
             }
 
             setIdsListToSearchCriteria(sc, ids);