search

diegogarciadev / android_snipeitapp_config

Automatic configuration of Android SnipeIT APP
29 stars 13 forks source link

API for non admin user lets them check-out/in as any other user, including admin #40

Open vzickus opened 1 year ago

vzickus commented 1 year ago

Describe the bug Creating an API key from a non-admin user, still allows the non-admin user to check out/in as any other user.

To Reproduce Create a user with limited access rights on the server, but allow them to create API keys. Link the API key to the app without modifying PHP (as it only makes sense that an admin would do that).

Expected behavior API key should only allow the user to check-out/in using their own username.

Smartphone (please complete the following information):

Additional context Alternative suggestions: have a login for user.

diegogarciadev commented 2 months ago

I'm not sure if I understand your message. Thanks.