search

chenejac / VIVOTestMigrationJIRA

0 stars 0 forks source link

VIVO-1929: Site Admin users cannot create new individuals via the GUI #1819

Closed chenejac closed 3 years ago

chenejac commented 3 years ago

Georgy Litvinov (Migrated from VIVO-1929) said:

As reported by Georgy on Slack:

 

To reproduce, create a user with Site Admin role.  Go to the Site Admin page, click "Add individual of this class" button.  User is returned to home page with alert message that it does not have permission to do that action.

 

Log shows the following and similar:

 

[PermissionsPolicy] No permission will approve AddObjectPropertyStatement: <?SOME_URI>

chenejac commented 3 years ago

Brian Lowe said:

It looks like EditRequestDispatchController, which currently checks authorization for various statement-level edit actions, also needs to include things like AddResource/EditResource/DropResource (possibly others).

chenejac commented 3 years ago

Benjamin Gross said:

An additional report: [https://groups.google.com/g/vivo-tech/c/zsk_0htnHTQ]

chenejac commented 3 years ago

Andrew Woods said:

Discussion with [~accountid:557058:a0d46356-8afd-4951-bfbb-1b29b1a511b5] landed on two potential solutions:

  1. Add more edit actions statements, as suggested in the ticket, or
  2. Encapsulate the sub-siteAdmin page access rules in a policy

Maybe taking option #1 for now... with a better future in mind.

chenejac commented 3 years ago

Benjamin Gross said:

https://github.com/vivo-project/Vitro/pull/206

chenejac commented 3 years ago

Andrew Woods said:

Looks and works good. It would be nice to have a second (or third) set of eyes on the fix.

chenejac commented 3 years ago

Georgy Litvinov said:

It works well. Looks good to me.

chenejac commented 3 years ago

Andrew Woods said:

Resolved with: https://github.com/vivo-project/Vitro/commit/2b3100076590e2698739a105b8e68535c3fee357