Red Hat Bugzilla – Full Text Bug Listing
|Summary:||JON GUI flow allows users without alert creation permissions to navigate to the "New Alert" page|
|Product:||[Other] RHQ Project||Reporter:||Mark Burchard <mburchar>|
|Component:||Core UI||Assignee:||John Mazzitelli <mazz>|
|Status:||CLOSED CURRENTRELEASE||QA Contact:||Mike Foley <mfoley>|
|Version:||1.3||CC:||ccrouch, cwelton, mdimaio, skondkar, tao|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2013-09-03 12:59:03 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:|
|Bug Blocks:||565628, 585306|
Description Mark Burchard 2010-02-01 14:16:40 EST
Description of problem: (from ticket filed by user) "I see if a user who has no 'Global Permissions', he can't define an alert. But eventhoug if this user open the tab 'Alert' the button 'New Definition' is aktiv. The user might think he can define an alert. But he click this button an enter to the edit page, he can't find any button of 'OK' etc. That means, in the fact this user can not create an alert. My question: Why not deactiv the button 'New Definition' and the other? This will cause confussion to the user without global permissions." (response by ccrouch) Fixing this would be part of a much broader effort to change the UI to be uniformly proactive (JON greys out things you can't do) versus reactive (you try to do something and JON tells you that you can't)
Comment 1 Mark Burchard 2010-02-01 14:44:55 EST
I have asked the customer to provide the exact Role permissions for this user, so that I can try and reproduce this.
Comment 2 wes hayutin 2010-02-16 11:53:40 EST
Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs. keyword: new = Tracking + FutureFeature + SubBug
Comment 3 wes hayutin 2010-02-16 11:58:54 EST
making sure we're not missing any bugs in rhq_triage
Comment 5 Corey Welton 2010-09-13 16:18:40 EDT
mazz, let's make sure this works.
Comment 6 John Mazzitelli 2011-03-21 14:35:50 EDT
this still exists, but in a different way. go to the Alert Definitions subtab and the New button is disabled. however, for those alert definitions that already exist, I can double click to view them (which is still OK) however, the "edit" button is enabled. I can click it and attempt to save. I do get a permissions error, but that comes from server side. We should disable the edit button if the user cannot edit an existing def
Comment 7 John Mazzitelli 2011-03-21 15:05:00 EDT
commit ab15b97 if you have a user that is not allowed to edit alerts, they can not create new alert defs or edit existing defs.
Comment 8 Sunil Kondkar 2011-06-14 08:10:01 EDT
Verified on build#123 (Version: 4.1.0-SNAPSHOT Build Number: a6d2d56) Created a group of resources having alerts defined and created a user. Created a role without edit alerts and assigned the resource group and the user to the role. Verified that the user without edit alerts can not create new alert definitions or edit existing definitions. The buttons New/Edit are disabled. Marking as verified.
Comment 9 Heiko W. Rupp 2013-09-03 12:59:03 EDT
Bulk closing of old issues that are in VERIFIED state.