Bug 789534

Summary:	User with read-everything role can (permanently?) delete system notifications
Product:	Red Hat Satellite	Reporter:	Corey Welton <cwelton>
Component:	WebUI	Assignee:	Partha Aji <paji>
Status:	CLOSED NOTABUG	QA Contact:	Katello QA List <katello-qa-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0.0	CC:	mmccune
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-21 18:38:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	747354

Description Corey Welton 2012-02-11 03:04:00 UTC

Description of problem:
If a user has been granted "read-everything" role (the pre-populated one we ship) and visits the system notifications, s/he gets the "Delete All " link and it is functional.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.  Create a new user, "jimbob"
2.  Grant jimbob the role of read-everything
3.  Login with user jimbob and navigate to the notification subsystem
4.  On the ensuing page, click "Delete All" and confirm.
  
Actual results:

(Some) notifications are  deleted - they disappear from screen
User sees Delete All link

Expected results:

User shouldn't even see the Delete All link in the first place.

Additional info:
I'm not immediately sure whether we're just deleting just those that this user can see. Or whether they just disappear from the UI but are still there for admin user. I would think that this user's notification view might/should be otherwise be the same as admin user?  In any case, we should just get rid of the Delete All link and be done with it.

Comment 1 Mike McCune 2012-02-13 23:14:56 UTC

+1 to getting rid of the Delete All if the user doesn't have the rights to delete stuff

Comment 2 Partha Aji 2012-02-14 21:20:35 UTC

I would argue this is indeed the desired behaviour. Notifications showing up under http://<fqdn>/katello/notices are custom to a user and hence deletable by the user. This behavior is similar to the user being able to edit his/her preferences (even if they do not have any privileges to edit anything).

Comment 3 Corey Welton 2012-02-21 18:38:56 UTC

I'm fine with the explanation above.  QA Closing.