ppazos / cabolabs-ehrserver

Open platform to manage and share standardized clinical data, designed by @ppazos at CaboLabs Health Informatics.
https://cabolabs.com
Apache License 2.0
177 stars 110 forks source link

Check access for each role to each section #1055

Closed ppazos closed 4 years ago

ppazos commented 4 years ago

Since we are not using the RequestMap, wee need to be sure EHRServer2 has the correct permissions for each section and each role in the Web Console, and that we don't show sections that are not accessible by the current logged in user.

ppazos commented 4 years ago

The menu items are filtered, but accessing admin urls from an accman or an orgman is not checking authorization, we need to add these checks in the auth interceptor and add the urls to the database per role as in the spring sec plugin.

ppazos commented 4 years ago

We are actually using RequestMap, and AuthInterceptor is actually verifying the role:

if (!authService.loggedInUserHasAnyRole(rm.configAttribute)) { render view: "/noPermissions.gsp" return false // all URLs are closed by default! }