Uploaded image for project: 'Nuxeo Web UI'
  1. Nuxeo Web UI
  2. WEBUI-935

Forbid access to user profile

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.0.0
    • Fix Version/s: 3.0.17
    • Component/s: Routing
    • Release Notes Summary:
      The access to user profile is denied to non admins.
    • Backlog priority:
      800
    • Sprint:
      UI - 2022-11

      Description

      Although the access to the page /admin/user-group-management is denied to non-admin thanks to the routing rule at https://github.com/nuxeo/nuxeo-web-ui/blob/maintenance-3.0.x/elements/routing.js#L75 , it is possible to access to a user profile with a URL like /nuxeo/ui/#!/admin/user-group-management/user/jdoe

      This ticket is to request that the pages under /admin/user-group-management are forbidden too , in order to have some consistency.

      Steps to reproduce:

      • Create a user "john"
      • Create a user "sarah"
      • Make sure that both users only have the members group, they should NOT have admin rights.
      • Login as sarah
      • Try to access [SERVER_URL]/nuxeo/ui/#!/admin/user-group-management/user/john

      => screen is displayed
      => expected:

      • access to this screen should be refused because sarah is not an administrator, behavior should be the same as if you try to access [SERVER_URL]nuxeo/ui/#!/admin/user-group-management
      • access to any URL beyond
        [SERVER_URL]/nuxeo/ui/#!/admin/user-group-management

        should behave the same as if you try to access

        [SERVER_URL]nuxeo/ui/#!/admin/user-group-management

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours
                  4h

                    PagerDuty