dotCMS / core

Headless/Hybrid Content Management System for Enterprises
http://dotcms.com
Other
802 stars 460 forks source link

Spike: Identify which sensitive admin actions are and are not logged #29009

Open john-thomas-dotcms opened 3 days ago

john-thomas-dotcms commented 3 days ago

Parent Issue

No response

Task

Task

We need to identify which of the following actions, when performed by any user, are logged. Specifically, for each of the actions, we need to identify:

Actions

  1. Users & Permissions:
    • [ ] Add a new user
    • [ ] Delete a user
    • [ ] Enable/Disable a user
    • [ ] Assign a new role to a user (specifically the CMS Admin role)
    • [ ] Remove a role from a user (specifically the CMS Admin role)
    • [ ] Impersonate a user (using the Login As functionality)
  2. Plugins
    • [ ] Upload a plugin
    • [ ] Start a plugin
    • [ ] Stop a plugin
    • [ ] Restart OSGI
  3. Sites
    • [ ] Add a site
    • [ ] Edit a site
    • [ ] Start a site
    • [ ] Stop a site
    • [ ] Delete a site
  4. Maintenance portlet
    • [ ] Re-index
    • [ ] Deactivate an index
    • [ ] Clear an index
    • [ ] Delete an index
  5. Configuration portlet
    • [ ] Upload license pack
    • [ ] Reset license

Proposed Objective

Customer Success

Proposed Priority

Priority 2 - Important

Acceptance Criteria

Provide a document with a table listing each of the actions on one row, with the name of the action in the first column, and answers to each of the questions in subsequent columns, something like the following:

Action Logged (Y/N) Log file Object Logged (Y/N) User Logged (Y/N) API Calls Logged (Y/N)
Add a user Y dotcms.log Y Y Y
Delete a user Y access.log N Y Y

Time-box the effort to 1 day's worth of work.

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response