Bug 747328 - user_change doesn't enforce permissions
Summary: user_change doesn't enforce permissions
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Beaker
Classification: Retired
Component: web UI
Version: 0.7
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified vote
Target Milestone: ---
Assignee: Raymond Mancy
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-10-19 14:00 UTC by Bill Peck
Modified: 2019-05-22 13:40 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-15 00:16:35 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Bill Peck 2011-10-19 14:00:50 UTC 
Description of problem:

Even though the Web interface doesn't present you with the option to take a system which is shared to everyone you can work around it by calling the action url yourself.

Version-Release number of selected component (if applicable):
0.7.3

Steps to Reproduce:
1. Find a machine owned by admin but in no groups
2. figure out the id of the system
3. ./user_change?id=165
  
Actual results:
System will now be reserved to you

Expected results:
Should not
Comment 1 Bill Peck 2012-01-23 16:28:50 UTC 
Status?
Note You need to log in before you can comment on or make changes to this bug.