search

janotav / ali-idea-plugin

HP ALI support for Intellij IDEA
Apache License 2.0
8 stars 10 forks source link

unauthorized user could delete requirement using the HP ALI plugin #37

Open yduan123 opened 9 years ago

yduan123 commented 9 years ago

HP ALI version: 3.13.133.193 Intellij Version: 14.0.3

Users cannot delete requirement in QC (via browser) due to limited privilege. But the same user was able to delete requirement in Intellij using the plugin, after confirming the delete prompt.

janotav commented 9 years ago

Is the workflow involved? If the enforcement is done via workflow, it cannot be supported by the plugin, which is not workflow-compliant.

yduan123 commented 9 years ago

Not sure if any workflow is involved. At least no explicit/customized workflow was configured. The user only has a standard QC role of "Tester" and is not supposed to perform any delete.

janotav commented 9 years ago

Can you please list the QC/ALM version and edition? Thanks.

yduan123 commented 9 years ago

HP Application Lifecycle Management Installation Details: Product version 11.52.536 Patch level 4

janotav commented 9 years ago

I'm not able to reproduce this on a very similar setup (11.52.572). Namely:

1/ if user only has viewer role, the deletion from Intellij fails (after dialog confirmation, insufficient permissions are reported and requirement is not removed)

2/ if user has "QATester" role, he is able to remove requirement both in QC and Intellij

As a possible enhancement the appropriate action could be disabled rather than failing. It's not what you are reporting though. Are you sure that in your case it is not disabled/disallowed by a workflow permission/mechanism?

yduan123 commented 9 years ago

Thanks. I'll ask QC admin about workflow. I changed my QC role to "Viewer" and got the following error when attempting to delete requirements using the plugin (I think it's the same as you test 1/) - The user #### was denied access to perform the operation on the object requirement(id=####) due to the following reasons: The permission setting for operation Delete doesn't allow user to perform the required operation on the secured object; The user is not the owner of the entity

Could you please also check whether you can delete requirement with "Tester" (not QATester) role?

janotav commented 9 years ago

Indeed, it's the error that I saw too and that's what is currently expected.

There is no "Tester" role on the freshly created project that I used. Let's wait for the additional info from your QC admin.