search

snax4a / service-quotes-web

Service Quotes React.js web app
service-quotes-web.vercel.app
0 stars 0 forks source link

Accounts have access to pages via direct URL where they should not #25

Closed SKVetr closed 3 years ago

SKVetr commented 3 years ago

What are the steps to reproduce this issue?

  1. Log in on any account
  2. Attempt to access any page via direct URL

What happens?

Account has access to page that access should not be possible.

What were you expecting to happen?

A information / page is displayed informing about forbidden access. Or user is redirected to dashboard.

Affected pages?

URL MANAGER MANAGER EXPECTED EMPLOYEE EMPLOYEE EXPECTED CUSTOMER CUSTOMER EXPECTED
/accounts ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/accounts/create ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
accounts/3a3221c4-9bb5-499b-81ac-cf719403179f ACCESS ACCESS ACCESS Shows it's own profile data Redirects to /account/details? ACCESS Redirects to /account/details?
/accounts/3a3221c4 Infinite load REPORTED ACCESS Shows it's own profile data Redirects to /account/details? ACCESS Redirects to /account/details?
/accounts/7542b6b8-638c-44c9-806b-0040667c32a9/edit ACCESS ACCESS ACCESS Shows it's own profile data Redirects to /account/details? ACCESS Redirects to /account/details?
/customers ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/customers/520078f5-df45-4ce7-bbe9-7636097fe864 ACCESS ACCESS UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS
/customers/520078f5 UNEXPECTED ERROR REPORTED UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS
/customers/520078f5-df45-4ce7-bbe9-7636097fe864/edit ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/employees ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/employees/f6ef58fb-ec14-4ec8-814b-65f4f69995e4 ACCESS ACCESS UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS
/employees/f6ef58fb UNEXPECTED ERROR REPORTED UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS
/employees/f6ef58fb-ec14-4ec8-814b-65f4f69995e4/edit ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/specializations ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/specializations/create ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/specializations/b4eda6fc-439f-4b6c-ae53-479d0a66b20c ACCESS ACCESS ACCESS NO ACCESS ACCESS NO ACCESS
/specializations/b4eda6fc ACCESS ACCESS Empty Page REPORTED ACCESS NO ACCESS ACCESS NO ACCESS
/payments ACCESS ACCESS ACCESS NO ACCESS ACCESS ACCESS
/payments/34f3dfe3-b5a3-48e0-a7e8-e1d1b39a39e6 ACCESS ACCESS ACCESS NO ACCESS ACCESS TO ALL ACCESS TO OWNED PAYMENTS ONLY
/payments/34f3dfe3 ACCESS ACCESS ACCESS NO ACCESS ACCESS ACCESS
/quotes ACCESS ACCESS ACCESS NO ACCESS ACCESS ACCESS
/quotes/2077b1c4-b9f8-4781-b58f-afe83648ff19 ACCESS ACCESS ACCESS NO ACCESS ACCESS TO ALL ACCESS TO OWNED QUOTE ONLY
/quotes/2077b1c4 ACCESS ACCESS ACCESS NO ACCESS ACCESS ACCESS
/addresses ACCESS NO ACCESS ACCESS NO ACCESS ACCESS ACCESS
/addresses/create ACCESS NO ACCESS ACCESS NO ACCESS ACCESS ACCESS
/addresses/0ae9ac1b-99f1-4203-9a4f-1f620dca41ba UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS ACCESS ACCESS
/addresses/0ae9ac1b UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR NO ACCESS UNEXPECTED ERROR REPORTED
/addresses/0ae9ac1b-99f1-4203-9a4f-1f620dca41ba/edit ACCESS NO ACCESS ACCESS NO ACCESS ACCESS ACCESS
/service-requests ACCESS ACCESS ACCESS ACCESS ACCESS ACCESS
/service-requests/create ACCESS ACCESS ACCESS NO ACCESS ACCESS ACCESS
/service-requests/9aefa8a3 ACCESS ACCESS ACCESS ACCESS ACCESS ACCESS
/service-requests//edit ACCESS NO ACCESS Form disappear after a second ACCESS NO ACCESS ACCESS NO ACCESS Form disappear after a second
/service-requests//edit ACCESS ACCESS ACCESS IF ASSIGNED NO ACCESS ACCESS ACCESS