# Lock and rights do not affect on scheduled actions. security bug

**URL:** <https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295>\
**Category:** Product Support\
**Created:** [April 6, 2020, 10:02am UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295 "2020-04-06T10:02:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![slnt\_opp](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/slnt_opp/32/6303_2.png) [@slnt\_opp](https://forum.opennebula.io/u/slnt_opp)\
**Post date:** [April 6, 2020, 10:02am UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295/1 "2020-04-06T10:02:37Z")

</div>

Even if vm is locked, or owner currently has no rights to manage/admin or even use(by lock) the VM, user can schedule action, e.g. resume, and turn his vm on.

Steps:

- Lock VM
- login as user
- schedule action, like resume
- wait
- vm is going to be resumed  
Expected: nothing should happen or/and action should have message, like cannot resume vm, because it’s locked/user has no rights [manage]

---

<div class="post-metadata">

**Author:** ![ahuertas](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/ahuertas/32/7487_2.png) [@ahuertas](https://forum.opennebula.io/u/ahuertas)\
**Post date:** [April 6, 2020, 3:57pm UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295/2 "2020-04-06T15:57:37Z")

</div>

Hello @slnt_opp

Could you please open an issue in our [GitHub](https://github.com/OpenNebula/one/issues) with the detailed information?

Thanks!

Best,  
Álex

---

<div class="post-metadata">

**Author:** ![pczerny](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/pczerny/32/6224_2.png) [@pczerny](https://forum.opennebula.io/u/pczerny)\
**Post date:** [April 6, 2020, 4:56pm UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295/3 "2020-04-06T16:56:13Z")

</div>

Hello @slnt_opp,  
which opennebula version do you use? (On command line you can check it with ‘oned --version’)

I just tested it with 5.10.0 and 5.10.4 and it works correctly, the schedule action fails.

---

<div class="post-metadata">

**Author:** ![slnt\_opp](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/slnt_opp/32/6303_2.png) [@slnt\_opp](https://forum.opennebula.io/u/slnt_opp)\
**Post date:** [April 7, 2020, 7:52am UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295/4 "2020-04-07T07:52:50Z")

</div>

We’re using `5.8.5`. Unfortunately i can’t update to 5.10 now

---

<div class="post-metadata">

**Author:** ![slnt\_opp](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/slnt_opp/32/6303_2.png) [@slnt\_opp](https://forum.opennebula.io/u/slnt_opp)\
**Post date:** [April 7, 2020, 8:14am UTC](https://forum.opennebula.io/t/lock-and-rights-do-not-affect-on-scheduled-actions-security-bug/8295/5 "2020-04-07T08:14:31Z")

</div>

[Done](https://github.com/OpenNebula/one/issues/4489)