Bug 1461526 - [RFE] classification ID via the REST API, is to give the user access to Settings-->Configuration-->Settings. This is not acceptable as it gives non privileged users R/W access to the settings panel.
[RFE] classification ID via the REST API, is to give the user access to Setti...
Status: NEW
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: API (Show other bugs)
5.7.0
Unspecified Unspecified
high Severity unspecified
: GA
: 5.10.0
Assigned To: Gregg Tanzillo
Dave Johnson
: FutureFeature, RFE
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-14 12:58 EDT by Saif Ali
Modified: 2018-05-11 02:06 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: Feature
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: CFME Core


Attachments (Terms of Use)

  None (edit)
Description Saif Ali 2017-06-14 12:58:29 EDT
Description of problem:
classification ID via the REST API, is to give the user access to Settings-->Configuration-->Settings. This is not acceptable as it gives non privileged users R/W access to the settings panel.

Version-Release number of selected component (if applicable):
4.2

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
Comment 3 abellott 2018-04-20 10:50:55 EDT
Can you provide more details on this, how to reproduce and what you mean by classification ID ?

maybe steps to reproduce including:
- role & product features of the unprivileged user
- API call that is returning everything  (i.e. GET /api/settings or GET /api/servers/:id/settings)

Thank you,
Alberto
Comment 4 Saif Ali 2018-04-24 10:49:28 EDT
Alberto, 
Let me ask the customer about the role & product features for the user, and the API call they using.

Note You need to log in before you can comment on or make changes to this bug.