Red Hat Bugzilla – Bug 560760
JON GUI flow allows users without alert creation permissions to navigate to the "New Alert" page
Last modified: 2013-09-03 12:59:03 EDT
Description of problem:
(from ticket filed by user)
"I see if a user who has no 'Global Permissions', he can't define an alert. But eventhoug if this user open the tab 'Alert' the button 'New Definition' is aktiv. The user might think he can define an alert. But he click this button an enter to the edit page, he can't find any button of 'OK' etc. That means, in the fact this user can not create an alert.
My question: Why not deactiv the button 'New Definition' and the other? This will cause confussion to the user without global permissions."
(response by ccrouch)
Fixing this would be part of a much broader effort to change the UI to be uniformly proactive (JON greys out things you can't do) versus reactive (you try to do something and JON tells you that you can't)
I have asked the customer to provide the exact Role permissions for this user, so that I can try and reproduce this.
Temporarily adding the keyword "SubBug" so we can be sure we have accounted for all the bugs.
new = Tracking + FutureFeature + SubBug
making sure we're not missing any bugs in rhq_triage
mazz, let's make sure this works.
this still exists, but in a different way.
go to the Alert Definitions subtab and the New button is disabled. however, for those alert definitions that already exist, I can double click to view them (which is still OK) however, the "edit" button is enabled. I can click it and attempt to save. I do get a permissions error, but that comes from server side. We should disable the edit button if the user cannot edit an existing def
if you have a user that is not allowed to edit alerts, they can not create new alert defs or edit existing defs.
Verified on build#123 (Version: 4.1.0-SNAPSHOT Build Number: a6d2d56)
Created a group of resources having alerts defined and created a user. Created a role without edit alerts and assigned the resource group and the user to the role.
Verified that the user without edit alerts can not create new alert definitions or edit existing definitions. The buttons New/Edit are disabled.
Marking as verified.
Bulk closing of old issues that are in VERIFIED state.