Feature #6854
closed
foreman api status is restricted for admin only
Added by Martin Ducar over 10 years ago.
Updated over 6 years ago.
Description
Libraries for foreman api handling like https://pypi.python.org/pypi/python-foreman use /api/status url to determine which foreman version is installed, which in my opinion is quite good behaviour. But foreman requires admin rights to access such information, if you are trying to script this as normal user, this is not possible. I couldn't come up with any reasonable way why it should be restricted only to admin. Please elaborate, why is it the case or please fix it that this restriction in not present. Or that you can configure the rights. Thank you
We've hit some situations where having /api/status improperly restricted to admin is causing some issues with general usage for non-admin users. Would love to see this fixed.
The file that maps permissions to URLs is app/services/foreman/access_permissions.rb and it just needs a new section.
You'd also need to add the permission name in db/seeds.d/03-permissions.rb.
I will take a stab at this when I find some time.
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/2557 added
- Pull request deleted (
)
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
- Assignee set to Ondřej Pražák
- Translation missing: en.field_release set to 72
Also available in: Atom
PDF