Bug 535022 (RHQ-1761)

Summary:	User without "Configure" permission can still change group config (if he is a member of that group role)
Product:	[Other] RHQ Project	Reporter:	Jeff Weiss <jweiss>
Component:	No Component	Assignee:	Ian Springer <ian.springer>
Status:	CLOSED NOTABUG	QA Contact:	Jeff Weiss <jweiss>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	1.2	CC:	ccrouch, dajohnso
Target Milestone:	---	Keywords:	SubBug
Target Release:	---	Flags:	jweiss: archived+
Hardware:	All
OS:	All
URL:	http://jira.rhq-project.org/browse/RHQ-1761
Whiteboard:
Fixed In Version:	1.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:	rev3351
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	534605

Description Jeff Weiss 2009-03-10 19:48:00 UTC

How to repeat:
As rhqadmin, create a compatible group (i used Datasources).  Create a role with all perms except "Configure".  Add a user to the role and the compat group to the role.

Log out and log in as that user.  Go to the compat group config page, Edit,  change one of the values, click save.  The update succeeds.  It should fail because the user doesn't have configure permission.

Comment 1 Ian Springer 2009-03-12 04:09:23 UTC

Jeff, I wasn't able to reproduce this. You said you gave the test role all perms except CONFIGURE. Did this include the MANAGE_INVENTORY global perm? If so, that would also implicitly grant all resource perms, including CONFIGURE.

Note, r3400 adds better error messages for permission errors.

Comment 2 Jeff Weiss 2009-03-12 13:09:04 UTC

No MANAGE_INVENTORY wasn't checked, since that forces CONFIGURE on as well.  If you have a test server, let me see if I can repro it there.

Comment 3 Jeff Weiss 2009-03-12 16:22:23 UTC

oh, i see the problem now.  ips, i thought you were referring to "Manage security" role that enables the other roles

Comment 4 Red Hat Bugzilla 2009-11-10 20:46:06 UTC

This bug was previously known as http://jira.rhq-project.org/browse/RHQ-1761