Bug 1794713

Summary:	[ceph-dashboard] read-only user can display RGW API keys
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Alfonso Martínez <almartin>
Component:	Ceph-Dashboard	Assignee:	Alfonso Martínez <almartin>
Status:	CLOSED ERRATA	QA Contact:	Sunil Angadi <sangadi>
Severity:	medium	Docs Contact:	Anjana Suparna Sriram <asriram>
Priority:	high
Version:	4.0	CC:	ceph-eng-bugs, ceph-qe-bugs, epuertat, hyelloji, sangadi, tserlin
Target Milestone:	rc	Flags:	hyelloji: needinfo-
Target Release:	4.1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	wip
Fixed In Version:	ceph-14.2.8-9.el8, ceph-14.2.8-7.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-19 17:32:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alfonso Martínez 2020-01-24 12:23:47 UTC

Description of problem:
read-only user can display RGW API keys

Version-Release number of selected component (if applicable):
RHCS 4

How reproducible:
Always

Steps to Reproduce:
1. Create user with read-only role.
2. Select any user's "Keys" tab.
3. Click on 'Show': you can see keys.

Actual results:
You can see keys.

Expected results:
Read-only user should not see this info.

Additional info:

Comment 1 RHEL Program Management 2020-01-24 12:23:53 UTC

Please specify the severity of this bug. Severity is defined here:
https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity.

Comment 9 errata-xmlrpc 2020-05-19 17:32:06 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:2231