Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Account / User profile / Front page: Incorrect/Outdated permissions for CreateDatabaseDump UI visibility #1905

Open
5 of 6 tasks
mn7216 opened this issue Mar 14, 2025 · 1 comment
Labels
admin Admin actions/tasks bug/error Bugs and errors (timeout) complexity: unknown Unknown days of work content: users Users (account/profile), user settings permissions User permissions priority: low Issues/Tasks that are not so important

Comments

@mn7216
Copy link
Contributor

mn7216 commented Mar 14, 2025

Website (required)

All

Describe the bug (required)

Users can be independently granted the CreateDatabaseDump permission.

However, that permission token does not allow users with it to actually view the database dump link or page:

// AdminIndex.tsx
{loginManager.canAdmin && (
	<>
		<h3>Database maintenance tasks{/* LOC */}</h3>
		<p>
			<Link to="/Admin/ActiveEdits">View active editors</Link>
			{/* LOC */}
		</p>
		<p>
			<a href="/Admin/CreateJsonDump">Create JSON dump{/* LOC */}</a>
		</p>
		<p>
			<a href="/Admin/RefreshDbCache">
				Refresh NHibernate 2nd level cache{/* LOC */}
			</a>
		</p>
		<p>
			<a href="/Admin/ClearCaches">
				Refresh .NET memory cache{/* LOC */}
			</a>
		</p>
	</>
)}
<!-- ./Admin/Index.cshtml -->
@if (UserContext.HasPermission(PermissionToken.Admin)) {
    <h3>Database maintenance tasks</h3>
    <p>
        <a asp-action="ActiveEdits">@("View active editors")</a>	
    </p>
    <p>
        <a asp-action="CreateJsonDump">@("Create JSON dump")</a>
    </p>	
    <p>
        <a asp-action="RefreshDbCache">@("Refresh NHibernate 2nd level cache")</a>
    </p>
    <p>
        <a asp-action="ClearCaches">@("Refresh .NET memory cache")</a>
    </p>
}

They are both dependent on the Admin token rather than the CreateDatabaseDump token.
This means that while those without Admin but with CreateDatabaseDump can create dumps by visiting vocadb.net/Admin/CreateJsonDump, they will not be able to choose the properties of the dump and will receive a 404.

To Reproduce (optional)

Steps to reproduce the behavior:
Go to vocadb.net/Admin/CreateJsonDump without the Admin token but with CDD
Note lack of link in UI and 404 upon visiting page

Expected behavior (optional)

The UI would be tied to CDD rather than Admin and would display for those with CDD

Checklist (required)

Fill out the checklist. Use strikethroughs or leave fields empty if you don't know or are unable to check/test.

  • Searched VocaDB/vocadb for duplicate issues.
    - [ ] Tested on the beta site. Impossible
  • Tested on different browsers (e.g. Firefox, Chrome, Safari, Edge).
  • Checked in private mode.
  • Cleared browser cache and cookies.
  • Checked the DevTools console.
  • Checked the syslog (mods+ only).
@mn7216 mn7216 added the bug/error Bugs and errors (timeout) label Mar 14, 2025
@szc126
Copy link
Collaborator

szc126 commented Mar 15, 2025

@andreoda andreoda added content: users Users (account/profile), user settings permissions User permissions admin Admin actions/tasks priority: low Issues/Tasks that are not so important complexity: unknown Unknown days of work labels Mar 15, 2025
@andreoda andreoda changed the title [Bug report] Incorrect/Outdated permissions for CreateDatabaseDump UI visibility Account / User profile / Front page: Incorrect/Outdated permissions for CreateDatabaseDump UI visibility Mar 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
admin Admin actions/tasks bug/error Bugs and errors (timeout) complexity: unknown Unknown days of work content: users Users (account/profile), user settings permissions User permissions priority: low Issues/Tasks that are not so important
Projects
Development

No branches or pull requests

3 participants