OpenSlides / openslides-meta

MIT License
0 stars 12 forks source link

A user with userCanUpdate in a meeting should be allowed to see organization_management_level of users. #87

Closed reiterl closed 5 months ago

reiterl commented 5 months ago

See https://github.com/OpenSlides/openslides-client/issues/3591

To check, if a user can change a Password of another user, they needs to know the organization_managment_level. With introducing user.canUpdate and allowing them to change passwords, this need appears.

Elblinator commented 5 months ago

This needs changes in the meta-repo organization_management_level needs to be changed to something between restriction_mode B and restriction mode D B allows the User to see the if they can see sensitive data D allows the User to see the if they can manage

The information needs to be visible if the User can update (sensitive data alone is not enough)

ostcar commented 5 months ago

Please keep in mind, that the autoupdate-restricter combines fields in the same restriction mode. So if two fields are in the same restriction mode, they are only calcuclated once. If you create new restriction modes, it costs CPU on the server.

Elblinator commented 5 months ago

I talked with @emanuelschuetze about it and it is okay to set the restriction mode from organization_managment_level to B