Bug 1365391 - Should only show users actions they have authority to perform
Summary: Should only show users actions they have authority to perform
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Management Console
Version: 3.3.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Jakub Hadvig
QA Contact: Yadan Pei
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-09 07:10 UTC by Yadan Pei
Modified: 2016-09-27 09:42 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-27 09:42:52 UTC
Target Upstream Version:


Attachments (Terms of Use)
Viewer-Builds-Pipeline (17.19 KB, image/png)
2016-08-09 07:15 UTC, Yadan Pei
no flags Details
Viewer-Request-Storage (24.52 KB, image/png)
2016-08-09 07:16 UTC, Yadan Pei
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1933 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.3 Release Advisory 2016-09-27 13:24:36 UTC

Description Yadan Pei 2016-08-09 07:10:29 UTC
Description of problem:
1. Edit Project option should not be listed on /console page when user only have view permision
2. Request Storage button should not be listed on Storage page when user only have view permision
3. Add to Project button on Builds->Pipelines page should not be listed when user only have view permision

Version-Release number of selected component (if applicable):
openshift v3.3.0.17
kubernetes v1.3.0+507d3a7
etcd 2.3.0+git

How reproducible:
Always

Steps to Reproduce:
1. User1 create a project
# oc new-project test
2. Grant user "userviewer" with view role on "test" project
# oc policy add-role-to-user view userviewer -n test
# oc policy add-role-to-user edit usereditor -n test
3. Login with user "userviewer" & "usereditor" and check all pages

Actual results:
3.
1) Edit Project option on /console page is provided when user only has view/edit permission
2) Request Storage button on Storage page is provided when user only has view permission
3) Add to Project button on Builds->Pipelines page is provided when user only has view permission
Expected results:
3
1) Edit project option should not be provided when user only has view/edit permision
2) - 3) These options should not be provided when user only has view permission


Additional info:
Delete project button on /console page is explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684

Comment 1 Yadan Pei 2016-08-09 07:15:48 UTC
Created attachment 1189069 [details]
Viewer-Builds-Pipeline

Comment 2 Yadan Pei 2016-08-09 07:16:12 UTC
Created attachment 1189070 [details]
Viewer-Request-Storage

Comment 3 Jakub Hadvig 2016-08-09 07:52:16 UTC
So the Edit action on the Project has the same reasoning as the Delete action which was explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684

Other two are valid issues.

Comment 4 openshift-github-bot 2016-08-09 13:02:31 UTC
Commit pushed to master at https://github.com/openshift/origin-web-console

https://github.com/openshift/origin-web-console/commit/36a9b5e66f0958ce692e7a2be56f7d2d97b92900
Bug 1365391: Add canI filter check to new buttons

Comment 5 XiaochuanWang 2016-08-11 02:43:38 UTC
Verified on oc/openshift v3.3.0.18
Storage page and Builds->Pipelines page are not reproduced.

Comment 7 errata-xmlrpc 2016-09-27 09:42:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1933


Note You need to log in before you can comment on or make changes to this bug.