Bug 1461526

Summary:	[RFE] classification ID via the REST API, is to give the user access to Settings-->Configuration-->Settings. This is not acceptable as it gives non privileged users R/W access to the settings panel.
Product:	Red Hat CloudForms Management Engine	Reporter:	Saif Ali <saali>
Component:	API	Assignee:	Gregg Tanzillo <gtanzill>
Status:	CLOSED WONTFIX	QA Contact:	Dave Johnson <dajohnso>
Severity:	high	Docs Contact:
Priority:	high
Version:	5.7.0	CC:	abellott, jhardy, jocarter, obarenbo, rspagnol, saali
Target Milestone:	GA	Keywords:	FutureFeature, RFE
Target Release:	5.11.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-27 18:49:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	Feature
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	CFME Core	Target Upstream Version:
Embargoed:

Description Saif Ali 2017-06-14 16:58:29 UTC

Description of problem:
classification ID via the REST API, is to give the user access to Settings-->Configuration-->Settings. This is not acceptable as it gives non privileged users R/W access to the settings panel.

Version-Release number of selected component (if applicable):
4.2

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 3 abellott 2018-04-20 14:50:55 UTC

Can you provide more details on this, how to reproduce and what you mean by classification ID ?

maybe steps to reproduce including:
- role & product features of the unprivileged user
- API call that is returning everything  (i.e. GET /api/settings or GET /api/servers/:id/settings)

Thank you,
Alberto

Comment 4 Saif Ali 2018-04-24 14:49:28 UTC

Alberto, 
Let me ask the customer about the role & product features for the user, and the API call they using.