Bug 560760

Summary: JON GUI flow allows users without alert creation permissions to navigate to the "New Alert" page
Product: [Other] RHQ Project Reporter: Mark Burchard <mburchar>
Component: Core UIAssignee: John Mazzitelli <mazz>
Status: CLOSED CURRENTRELEASE QA Contact: Mike Foley <mfoley>
Severity: medium Docs Contact:
Priority: low    
Version: 1.3CC: ccrouch, cwelton, mdimaio, skondkar, tao
Target Milestone: ---Keywords: SubBug
Target Release: ---   
Hardware: All   
OS: All   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-09-03 12:59:03 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 565628, 585306    

Description Mark Burchard 2010-02-01 14:16:40 EST
Description of problem:

(from ticket filed by user)

"I see if a user who has no 'Global Permissions', he can't define an alert. But eventhoug if this user open the tab 'Alert' the button 'New Definition' is aktiv. The user might think he can define an alert. But he click this button an enter to the edit page, he can't find any button of 'OK' etc. That means, in the fact this user can not create an alert.

My question: Why not deactiv the button 'New Definition' and the other? This will cause confussion to the user without global permissions."

(response by ccrouch)

Fixing this would be part of a much broader effort to change the UI to be uniformly proactive (JON greys out things you can't do) versus reactive (you try to do something and JON tells you that you can't)
Comment 1 Mark Burchard 2010-02-01 14:44:55 EST
I have asked the customer to provide the exact Role permissions for this user, so that I can try and reproduce this.
Comment 2 wes hayutin 2010-02-16 11:53:40 EST
Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs.

new = Tracking + FutureFeature + SubBug
Comment 3 wes hayutin 2010-02-16 11:58:54 EST
making sure we're not missing any bugs in rhq_triage
Comment 5 Corey Welton 2010-09-13 16:18:40 EDT
mazz, let's make sure this works.
Comment 6 John Mazzitelli 2011-03-21 14:35:50 EDT
this still exists, but in a different way.

go to the Alert Definitions subtab and the New button is disabled. however, for those alert definitions that already exist, I can double click to view them (which is still OK) however, the "edit" button is enabled. I can click it and attempt to save. I do get a permissions error, but that comes from server side. We should disable the edit button if the user cannot edit an existing def
Comment 7 John Mazzitelli 2011-03-21 15:05:00 EDT
commit ab15b97

if you have a user that is not allowed to edit alerts, they can not create new alert defs or edit existing defs.
Comment 8 Sunil Kondkar 2011-06-14 08:10:01 EDT
Verified on build#123 (Version: 4.1.0-SNAPSHOT Build Number: a6d2d56)

Created a group of resources having alerts defined and created a user. Created a role without edit alerts and assigned the resource group and the user to the role.

Verified that the user without edit alerts can not create new alert definitions or edit existing definitions. The buttons New/Edit are disabled.

Marking as verified.
Comment 9 Heiko W. Rupp 2013-09-03 12:59:03 EDT
Bulk closing of old issues that are in VERIFIED state.