Bug #16884
closedCreate permissions do not check filter limits
Description
Description of problem:
The user is able to create resource in taxonomies which were not added/associated to resource filter of role.
Also the search condition is ignored on creation.
Version-Release number of selected component (if applicable):
Foreman 1.5+ (including 1.14-dev) / Satellite 6.3 snap 3.0
How reproducible:
Always
Steps to Reproduce:
1. Create role with Organization A and Location A taxonomies.
2. Create a filter for resource type for which taxonomies can be applied and without overriding it.
e.g Domain Filter
3. Create a new user with different taxonomies than above role. Suppose Organization B and Location B.
4. Assign the role to user.
5. Login with new user.
6. Attempt to create a domain(or any resource type filter added in role) in user taxonomies(which are not the same as filter taxonomies).
Similarly in step 3, search condition can be specified, e.g. name ~ a
Actual results:
1. Create permission is not honoring the resourse filter limits.
2. The resource is created in the user associated taxonomies which are not permitted by resource filter.
Similarly the resource is created if name ~ a condition was specified in filter and name "b" was used.
Expected results:
1.Create permissions should check filter limits.
2. The resource should not be created by user in taxonomies to which filter doesn't gives permission.
3. Some informative message should be displayed for unable to create resource due to no permissions from resource filter end.
Updated by Marek Hulán over 8 years ago
- Subject changed from Create permissions do not check filter limits to Create permissions do not check filter limits
- Target version set to 115
Updated by Marek Hulán over 8 years ago
- Related to Tracker #4552: New permissions/authorization system issues added
Updated by Marek Hulán over 8 years ago
- Target version changed from 115 to 1.4.2
Updated by Marek Hulán about 8 years ago
- Status changed from New to Assigned
- Assignee set to Marek Hulán
Updated by Marek Hulán about 8 years ago
- Target version changed from 1.4.2 to 1.4.4
Updated by The Foreman Bot about 8 years ago
- Status changed from Assigned to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/4030 added
Updated by Marek Hulán about 8 years ago
- Target version changed from 1.4.4 to 1.10.1
Updated by Marek Hulán about 8 years ago
- Target version changed from 1.10.1 to 1.10.2
Updated by Marek Hulán about 8 years ago
- Target version changed from 1.10.2 to 1.11.2
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.11.2 to 1.11.4
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.11.4 to 1.12.1
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.12.1 to 1.12.3
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.12.3 to 1.13.0
Updated by Marek Hulán over 7 years ago
- Target version changed from 1.13.0 to 1.13.2
Updated by Marek Hulán over 7 years ago
- Target version changed from 1.13.2 to 1.13.4
Updated by Marek Hulán over 7 years ago
- Target version changed from 1.13.4 to 115
Updated by Marek Hulán over 7 years ago
- Related to Bug #20135: Fix tests after create and edit permissions started to be enforced added
Updated by Marek Hulán over 7 years ago
- Related to Bug #20136: Ignore create_tasks permission verification added
Updated by Marek Hulán over 7 years ago
- Related to Bug #20333: Similar to create permission, we need to ignore update permission added
Updated by Marek Hulán over 7 years ago
- Target version changed from 115 to 1.17.0-RC2
Updated by Anonymous over 7 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset 8dcc90bea24b7069e9ec7431835aac909fee30f4.
Updated by Marek Hulán over 7 years ago
- Translation missing: en.field_release set to 240
Updated by Marek Hulán over 7 years ago
- Related to Bug #20385: rake db:seed fails for plugins added
Updated by Marek Hulán over 7 years ago
- Related to Bug #20384: Initial db:seed fails added
Updated by Adam Ruzicka over 7 years ago
- Related to Bug #20391: Tests are failing due to permission changes added
Updated by The Foreman Bot over 7 years ago
- Pull request https://github.com/theforeman/foreman/pull/4705 added
Updated by Marek Hulán over 7 years ago
- Related to Refactor #20455: Replace execute permission with create_template_invocation added
Updated by Marek Hulán over 7 years ago
- Related to Bug #21065: Can't create configuration as a user with just "Manager" and "Virt-who Manager" roles added
Updated by Anonymous almost 7 years ago
- Related to Bug #22010: Hostgroup creation/edition issue added
Updated by Marek Hulán almost 7 years ago
- Related to Bug #22983: Missing permissions seed entry for HostgroupClass added
Updated by Lukas Zapletal over 6 years ago
- Related to Bug #25207: Invalid single-table inheritance type: Host::Discovered is not a subclass of Host::Managed added