-
Type: Bug
-
Status: Open
-
Priority: Minor
-
Resolution: Unresolved
-
Affects Version/s: 8.10
-
Fix Version/s: QualifiedToSchedule
-
Component/s: Rest API, User Profile / User Manager
-
Tags:
The powerusers group name should not be hardcoded in java code, as it is allowed to override corresponding filters to make this configurable (in case some actions should be possible to some users part of a particlar group that would not be the powerusers one)
So check at https://github.com/nuxeo/nuxeo/blob/master/nuxeo-features/rest-api/nuxeo-rest-api-server/src/main/java/org/nuxeo/ecm/restapi/server/jaxrs/usermanager/UserToGroupObject.java#L76 should be replaced by a filter check.
See http://explorer.nuxeo.com/nuxeo/site/distribution/Nuxeo%20DM-7.10/viewContribution/org.nuxeo.connect.client.actions--filters for the filter to check, "usersGroupsManagementAccess" seems to fit the need, in conjunction with ActionManager#checkFilter
- is required by
-
NXP-21225 Improper check if user can administrate users and groups
- Resolved