Skip to content
This repository has been archived by the owner on Mar 19, 2024. It is now read-only.

[Bug] When creating role, user can select roles that they cannot assign #183

Closed
bartvanb opened this issue Dec 6, 2023 · 2 comments
Closed
Assignees
Labels
bug Something isn't working

Comments

@bartvanb
Copy link
Member

bartvanb commented Dec 6, 2023

Describe the bug
A user should only be able to assign permissions to other users that are same level or lower than they have themselves. This prevents that a regular user can create a new role with more permissions and thereby elevate their own permissions.

This is currently not the case: see screenshots below, where a user can assign global permissions that they do not have themselves.

Expected behavior
In the create role component, a user can only tick boxes that they are allowed to assign

Screenshots
image
Top: which permissions the logged-in user (with role 'Collaboration admin') has
Bottom: which permissions they can assign

@bartvanb bartvanb added the bug Something isn't working label Dec 6, 2023
@bartvanb bartvanb added this to Sprints Dec 6, 2023
@github-project-automation github-project-automation bot moved this to Todo in Sprints Dec 6, 2023
@github-actions github-actions bot added the New label Dec 6, 2023
@bartvanb bartvanb removed the New label Dec 11, 2023
@eutj
Copy link
Contributor

eutj commented Dec 11, 2023

There is a bug in this bug report!
This is the correct screenshot when creating a role as collaboration admin:
image

@bartvanb
Copy link
Member Author

Cool :-)
I think it might have been an issue with logging in multiple times with different users that had different permissions, and this has probably been solved by 40b0f23

@github-project-automation github-project-automation bot moved this from Todo to Done in Sprints Dec 11, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
Status: Done
Development

No branches or pull requests

2 participants