After creating a role for "Read System in Environment, PRODUCTION" and assigning that role to a new user, login as that user. Visiting Systems By Environment page shows the env selector with only PRODUCTION clickable which is correct. Note the URL in the browser, though, and change the trailing env_id param to another number. Reload the page: Systems in the new env_id are displayed (though the env selector still is locked to PRODUCTION).
Should be fixed as of http://git.fedorahosted.org/git/?p=katello.git;a=commit;h=cda2c2349242b9c2d8116cb54302dacbf4967c75
mass ON_QA move
Verified on: * candlepin-0.5.18-1.el6.noarch * candlepin-tomcat6-0.5.18-1.el6.noarch * katello-0.1.229-2.el6.noarch * katello-all-0.1.229-2.el6.noarch * katello-certs-tools-1.0.2-2.el6.noarch * katello-cli-0.1.44-2.el6.noarch * katello-cli-common-0.1.44-2.el6.noarch * katello-common-0.1.229-2.el6.noarch * katello-configure-0.1.61-2.el6.noarch * katello-glue-candlepin-0.1.229-2.el6.noarch * katello-glue-foreman-0.1.229-2.el6.noarch * katello-glue-pulp-0.1.229-2.el6.noarch * katello-httpd-ssl-key-pair-1.0-1.noarch * katello-qpid-broker-key-pair-1.0-1.noarch * katello-repos-0.1.5-1.el6.noarch * katello-selinux-0.1.3-1.el6.noarch * katello-trusted-ssl-cert-1.0-1.noarch * pulp-0.0.265-1.el6.noarch * pulp-common-0.0.265-1.el6.noarch * pulp-selinux-server-0.0.265-1.el6.noarch