search

specify / specify7

Specify 7
https://www.specifysoftware.org/products/specify-7/
GNU General Public License v2.0
64 stars 36 forks source link

Statistics items shown with 'No permission' show results when exported #5030

Open emenslin opened 3 months ago

emenslin commented 3 months ago

Describe the bug When an item in statistics shows up as 'no permission' the user can still see what the results of those queries would be by downloading as TSV

To Reproduce Steps to reproduce the behavior:

  1. Log in as a user where some statistics items show up as 'no permission'
  2. Go to statistics-> see that some items say no permission
  3. Download as TSV
  4. Open file
  5. See error

Expected behavior The items shown as no permission should not show up when exported

Screenshots

https://github.com/specify/specify7/assets/150940840/2b62bdc1-c5e6-4d16-b102-ad54f23a328b

Please, also fill out the following information manually:

realVinayak commented 3 months ago

Ah, these will appear if it is the first load. If you refresh, those should disappear (you won't see that row in the export). This will be tricky to fix since the backend returns the stats with values, but frontend hides them with text "NO PERMISSION". The proper fix would be on the backend (detecting which stats should be NO PERMISSION) because otherwise somebody could look at network request to get the stat value.

emenslin commented 2 months ago

Can recreate in edge (7.9.6)