Bug 1365391

Summary: Should only show users actions they have authority to perform
Product: OpenShift Container Platform Reporter: Yadan Pei <yapei>
Component: Management ConsoleAssignee: Jakub Hadvig <jhadvig>
Status: CLOSED ERRATA QA Contact: Yadan Pei <yapei>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.3.0CC: aos-bugs, jokerman, mmccomas, tdawson, xiaocwan
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-27 09:42:52 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Viewer-Builds-Pipeline
none
Viewer-Request-Storage none

Description Yadan Pei 2016-08-09 07:10:29 UTC 
Description of problem:
1. Edit Project option should not be listed on /console page when user only have view permision
2. Request Storage button should not be listed on Storage page when user only have view permision
3. Add to Project button on Builds->Pipelines page should not be listed when user only have view permision

Version-Release number of selected component (if applicable):
openshift v3.3.0.17
kubernetes v1.3.0+507d3a7
etcd 2.3.0+git

How reproducible:
Always

Steps to Reproduce:
1. User1 create a project
# oc new-project test
2. Grant user "userviewer" with view role on "test" project
# oc policy add-role-to-user view userviewer -n test
# oc policy add-role-to-user edit usereditor -n test
3. Login with user "userviewer" & "usereditor" and check all pages

Actual results:
3.
1) Edit Project option on /console page is provided when user only has view/edit permission
2) Request Storage button on Storage page is provided when user only has view permission
3) Add to Project button on Builds->Pipelines page is provided when user only has view permission
Expected results:
3
1) Edit project option should not be provided when user only has view/edit permision
2) - 3) These options should not be provided when user only has view permission


Additional info:
Delete project button on /console page is explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684
Comment 1 Yadan Pei 2016-08-09 07:15:48 UTC 
Created attachment 1189069 [details]
Viewer-Builds-Pipeline
Comment 2 Yadan Pei 2016-08-09 07:16:12 UTC 
Created attachment 1189070 [details]
Viewer-Request-Storage
Comment 3 Jakub Hadvig 2016-08-09 07:52:16 UTC 
So the Edit action on the Project has the same reasoning as the Delete action which was explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684

Other two are valid issues.
Comment 4 openshift-github-bot 2016-08-09 13:02:31 UTC 
Commit pushed to master at https://github.com/openshift/origin-web-console

https://github.com/openshift/origin-web-console/commit/36a9b5e66f0958ce692e7a2be56f7d2d97b92900
Bug 1365391: Add canI filter check to new buttons
Comment 5 XiaochuanWang 2016-08-11 02:43:38 UTC 
Verified on oc/openshift v3.3.0.18
Storage page and Builds->Pipelines page are not reproduced.
Comment 7 errata-xmlrpc 2016-09-27 09:42:52 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1933