Bug 1662405 - 403 on attempt to open Packages Actions tab as user with viewer role
Summary: 403 on attempt to open Packages Actions tab as user with viewer role
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Hosts - Content
Version: 6.5.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: 6.5.0
Assignee: Partha Aji
QA Contact: Andrii Balakhtar
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-28 08:35 UTC by Andrii Balakhtar
Modified: 2019-11-05 22:43 UTC (History)
1 user (show)

Fixed In Version: tfm-rubygem-katello-3.10.0.17-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-14 12:39:37 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 25907 0 None None None 2019-01-22 23:12:19 UTC
Red Hat Product Errata RHSA-2019:1222 0 None None None 2019-05-14 12:39:45 UTC

Description Andrii Balakhtar 2018-12-28 08:35:50 UTC
Description of problem:
User with viewer role can't open Packages Actions tab on Content Host details page, gets redirected to 'The page you were looking for doesn't exist.' page instead.

Version-Release number of selected component (if applicable):
Sat6.5 SNAP 9

How reproducible:
Always

Steps to Reproduce:
1. Create non-admin user with viewer role
2. Open any content host, select Packages -> Actions
3.

Actual results:
Redirected to 'The page you were looking for doesn't exist.'

Expected results:
As user doesn't have enough permissions to perform any package actions, corresponding tab shouldn't be visible to him.

Additional info:

Comment 2 Partha Aji 2019-01-22 23:12:18 UTC
Connecting redmine issue https://projects.theforeman.org/issues/25907 from this bug

Comment 3 Bryan Kearney 2019-01-26 01:09:22 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/25907 has been resolved.

Comment 5 Andrii Balakhtar 2019-02-05 11:21:21 UTC
VERIFIED on Sat6.5 Snap 14
Automated test passes, `Actions` tab is no longer visible to read-only user.

Comment 7 errata-xmlrpc 2019-05-14 12:39:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:1222


Note You need to log in before you can comment on or make changes to this bug.