Defect #1540
closed
Displaying bulk actions for systems require ROLE_READ and SYSTEM_DELETE
100%
Description
Version: 9.5.0-SNAPSHOT
Displaying bulk actions for systems now require permissions:- ROLE_READ (rest controller for endpoint /systems/bulk/actions)
- SYSTEM_DELETE (to display row selection - checkboxes)
It should require only SYSTEM_READ. Other permissions are specific for different bulk actions.
Related issues
Updated by Alena Peterová almost 6 years ago
- Related to Task #1357: Create Export system Bulk-Action added
Updated by Radek Tomiška almost 6 years ago
System delete bulk action should have SYSTEM_DELETE permission.
I checked some bulk actions for the system (acc) and they are correctly configured (delete, duplicate). Please specify concrete bulk action, which should be reconfigured.
The issue is maybe connected with FE only (SystemTable), where additional SYSTEM_DELETE permission is required and should be removed (it's forgotten, when BE action were implemented). It's ok? The issue can be solved with removal this SYSTEM_DELETE permission?
Updated by Alena Peterová almost 6 years ago
- Subject changed from Bulk actions for systems require ROLE_READ and SYSTEM_DELETE to Displaying bulk actions for systems require ROLE_READ and SYSTEM_DELETE
Radek Tomiška wrote:
System delete bulk action should have SYSTEM_DELETE permission.
I checked some bulk actions for the system (acc) and they are correctly configured (delete, duplicate). Please specify concrete bulk action, which should be reconfigured.
I agree, the individual actions require correct permissions.
The issue is maybe connected with FE only (SystemTable), where additional SYSTEM_DELETE permission is required and should be removed (it's forgotten, when BE action were implemented). It's ok? The issue can be solved with removal this SYSTEM_DELETE permission?
Yes, exactly, I meant FE. I can't use any system bulk action now (e.g. Duplicate system), if I don't have both ROLE_READ and SYSTEM_DELETE. The ROLE_READ is required by the REST endpoints for system bulk actions, but I think it's copy-paste mistake from role bulk actions - it should require SYSTEM_READ instead.
Updated by Radek Tomiška almost 6 years ago
- Tracker changed from Task to Defect
- Assignee changed from Ondřej Kopr to Radek Tomiška
I checked SystemDuplicateBulkAction and there is a correct permissions on BE - SYSTEM_READ and SYSTEM_UPDATE.
But i see the issue now, you have a right - copy / paste with forgotten ROLE_* permissions are directly on the rest endpoint (SysSystemController), where all actions are called - will be fixed there (+FE above).
Updated by Radek Tomiška almost 6 years ago
- Status changed from New to In Progress
- Target version set to Quartz (9.6.0)
Updated by Radek Tomiška almost 6 years ago
- Status changed from In Progress to Needs feedback
- Assignee changed from Radek Tomiška to Vít Švanda
- % Done changed from 0 to 90
I've fixed all endpoints for the bulk action on all product controlers - they are under '<GROUP>_READ' permission now => every bulk action has her own security setting. I've added rest tests.
Commit:
https://github.com/bcvsolutions/CzechIdMng/commit/f100faa98a0e04809eef9e78db2b26e00ac64b66
Could you do a feedback, pls?
Updated by Vít Švanda over 5 years ago
- Status changed from Needs feedback to Resolved
- Assignee changed from Vít Švanda to Radek Tomiška
- % Done changed from 90 to 100
I made a review . It works nicely. Thanks for it.
Updated by Radek Tomiška over 5 years ago
- Status changed from Resolved to Closed