-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Advanced Workflow: permissions assigned to managers/members should be filtered by owner and resource group metadata only #9115
Labels
3.3.x
4.0.x
master
regression
Issues related to regressions.
security
Pull requests that address a security vulnerability
Comments
confirmed @afabiani |
afabiani
pushed a commit
that referenced
this issue
Apr 15, 2022
…bers should be filtered by owner and resource group metadata only
This was referenced Apr 15, 2022
github-actions bot
pushed a commit
that referenced
this issue
Apr 19, 2022
…bers should be filtered by owner and resource group metadata only (#9119) * [Fixes #9106] Implement API for compact permissions * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [Fixes #9114] Group managers are assigned Manage permission on adding a group with any permission in share permissions form * [Fixes #9115] Advanced Workflow: permissions assigned to managers/members should be filtered by owner and resource group metadata only * - Fixes: The "get_all_level_info" forcibly and wrongly writes manages into the "perm_spec" - Fixes: The "update_metadata" does not forward information about group and approval status change to the update method * - Fixes: promotion/demotion consider the owner's group also
giohappy
pushed a commit
that referenced
this issue
Apr 19, 2022
…bers should be filtered by owner and resource group metadata only (#9119) (#9159) * [Fixes #9106] Implement API for compact permissions * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [CircleCi] Fix tests * [Fixes #9114] Group managers are assigned Manage permission on adding a group with any permission in share permissions form * [Fixes #9115] Advanced Workflow: permissions assigned to managers/members should be filtered by owner and resource group metadata only * - Fixes: The "get_all_level_info" forcibly and wrongly writes manages into the "perm_spec" - Fixes: The "update_metadata" does not forward information about group and approval status change to the update method * - Fixes: promotion/demotion consider the owner's group also Co-authored-by: Alessio Fabiani <[email protected]>
afabiani
pushed a commit
that referenced
this issue
Apr 19, 2022
…ned to managers/members should be filtered by owner and resource group metadata only
afabiani
pushed a commit
that referenced
this issue
Apr 19, 2022
…assigned to managers/members should be filtered by owner and resource group metadata only
giohappy
pushed a commit
that referenced
this issue
Apr 19, 2022
…ned to managers/members should be filtered by owner and resource group metadata only (#9167)
giohappy
pushed a commit
that referenced
this issue
Apr 19, 2022
…assigned to managers/members should be filtered by owner and resource group metadata only (#9172)
github-actions bot
pushed a commit
that referenced
this issue
Apr 19, 2022
…assigned to managers/members should be filtered by owner and resource group metadata only (#9172)
giohappy
pushed a commit
that referenced
this issue
Apr 19, 2022
…assigned to managers/members should be filtered by owner and resource group metadata only (#9172) (#9176) Co-authored-by: Alessio Fabiani <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.3.x
4.0.x
master
regression
Issues related to regressions.
security
Pull requests that address a security vulnerability
Expected Behavior
When automatically setting the permissions through the advanced workflow, the
groups
to consider in order to set themanagers
andmembers
ones are only:resource.owner
group (if any)resource.metadata.group
(if any)That means that whenever we manually assign some sort of permission to another
group
, whatever, through theshare
panel, unless one of the previous condition are met, there won't be any automatic action.Actual Behavior
The advanced workflow consider any
group
having some sort of access to the resource.Steps to Reproduce the Problem
test_group1
and assign it totest_user1
, also createtest_manager1
andtest_member1
test_group2
and createtest_manager2
andtest_member2
test_group3
and createtest_manager3
andtest_member3
test_user1
, verify thetest_manager1
andtest_member1
have permissions to theresource
test_group2
to the resource, verify thetest_manager2
andtest_member2
have permissions to theresource
view
permissions totest_group3
, verify no further/specifc permissions have been set fortest_manager3
ortest_member3
Specifications
The text was updated successfully, but these errors were encountered: