search

Cloudkibo / KiboPush

0 stars 1 forks source link

Acting user's platform should not be changed when a super user is viewing his account. #9969

Open saniasiddiqui opened 3 years ago

saniasiddiqui commented 3 years ago

Right now we are allowing super user to change the platform and view acting user's information. There should be a work around for this scenario. We should not allow actual platform of user to be changed by super user. This comes from discussion after team testing backdoor #9784

saniasiddiqui commented 3 years ago

Here we need to discuss the solution. Current Functionality:

  1. We have platform field in user table, that stores the value of currently set platform of the user. Based on this field settings, siderbar, notifications etc are shown to the user.
  2. When a super user views any user profile, we are allowing him to 'change; the platform so that he is able to view user information for all his connected platforms. However we do save the original platform of the user
  3. When the super user exits the user view, original platform is restored for the acting user. image

There are two potential problems that can occur on platform change:

  1. Super user opens a user's view, changes platform and signs out. Forgets to exit the user view. In this case the user might find that his platform has been changed.
  2. Actual user logs in while he is being viewed by super user and finds his platform changed.

P.s. We can restrict the super user to not be able to change platform, in that case we will not be able to view user's information for other connected platforms.

@sojharo @ImranBinShoukat please discuss. Thanks.

sojharo commented 3 years ago

When super user changes the platform it should not persist in database. We can put this check on server side or client side. If we can do this, then it would solve the issue.

Go ahead with the solution.