Red Hat Bugzilla – Bug 1365391
Should only show users actions they have authority to perform
Last modified: 2016-09-27 05:42:52 EDT
Description of problem: 1. Edit Project option should not be listed on /console page when user only have view permision 2. Request Storage button should not be listed on Storage page when user only have view permision 3. Add to Project button on Builds->Pipelines page should not be listed when user only have view permision Version-Release number of selected component (if applicable): openshift v3.3.0.17 kubernetes v1.3.0+507d3a7 etcd 2.3.0+git How reproducible: Always Steps to Reproduce: 1. User1 create a project # oc new-project test 2. Grant user "userviewer" with view role on "test" project # oc policy add-role-to-user view userviewer -n test # oc policy add-role-to-user edit usereditor -n test 3. Login with user "userviewer" & "usereditor" and check all pages Actual results: 3. 1) Edit Project option on /console page is provided when user only has view/edit permission 2) Request Storage button on Storage page is provided when user only has view permission 3) Add to Project button on Builds->Pipelines page is provided when user only has view permission Expected results: 3 1) Edit project option should not be provided when user only has view/edit permision 2) - 3) These options should not be provided when user only has view permission Additional info: Delete project button on /console page is explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684
Created attachment 1189069 [details] Viewer-Builds-Pipeline
Created attachment 1189070 [details] Viewer-Request-Storage
So the Edit action on the Project has the same reasoning as the Delete action which was explained in https://bugzilla.redhat.com/show_bug.cgi?id=1355684 Other two are valid issues.
Commit pushed to master at https://github.com/openshift/origin-web-console https://github.com/openshift/origin-web-console/commit/36a9b5e66f0958ce692e7a2be56f7d2d97b92900 Bug 1365391: Add canI filter check to new buttons
Verified on oc/openshift v3.3.0.18 Storage page and Builds->Pipelines page are not reproduced.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2016:1933