Bug #26952: User with only  “Inventory” rights has a notification error when changing tab - Rudder - Issue Tracker

Actions

Copy link

Bug #26952

open

User with only  “Inventory” rights has a notification error when changing tab

Added by Michel BOUISSOU about 2 months ago. Updated 3 days ago.

Status:

Pending release

Priority:

1 (highest)

Assignee:

Clark ANDRIANASOLO

Category:

Web - UI & UX

Target version:

8.3.3

Pull Request:

https://github.com/Normation/rudder/p...

Severity:

Critical - prevents main use of Rudder | no workaround | data loss | security

UX impact:

I hate Rudder for that

User visibility:

Effort required:

Priority:

Name check:

To do

Fix check:

Checked

Regression:

Description

A ˘toto" user, created with only “Inventory” rights can access a lot more :

- System updates
- Nodes properties
- Node technical logs (that may show sensitive information)

Plus clicking on many tabs produce an error message :

Error
Error when Getting node compliance, details:
Unknown error

Even though some content gets displayed

Files

Download all files

User_toto_250522a.png (49.6 KB) User_toto_250522a.png	Toto only has inventory rights	Michel BOUISSOU, 2025-05-23 16:55
User_inventory_access_250522a_updates.png (211 KB) User_inventory_access_250522a_updates.png	Toto can see system updates	Michel BOUISSOU, 2025-05-23 16:56
User_inventory_access_250522b_properties.png (189 KB) User_inventory_access_250522b_properties.png	Toto can see nodes properties	Michel BOUISSOU, 2025-05-23 16:56
User_inventory_access_250522c_tech_logs.png (263 KB) User_inventory_access_250522c_tech_logs.png	Toto can see technical logs	Michel BOUISSOU, 2025-05-23 16:56
User_inventory_access_250522d_error.png (8.2 KB) User_inventory_access_250522d_error.png	Error message often displayed	Michel BOUISSOU, 2025-05-23 16:56
clipboard-202506051548-ddp9w.png (96 KB) clipboard-202506051548-ddp9w.png		Clark ANDRIANASOLO, 2025-06-05 15:48
clipboard-202506051548-7hy8k.png (96 KB) clipboard-202506051548-7hy8k.png		Clark ANDRIANASOLO, 2025-06-05 15:48

Related issues 1 (1 open — 0 closed)

Actions

Copy link

Updated by Vincent MEMBRÉ about 1 month ago

Target version changed from 8.3.2 to 8.3.3

Actions

Copy link

Updated by François ARMAND about 1 month ago

Assignee set to Clark ANDRIANASOLO
Priority changed from To review to 1 (highest)
Severity changed from Major - prevents use of part of Rudder | no simple workaround to Critical - prevents main use of Rudder | no workaround | data loss | security

It's OK that inventory role gives access to node information, so OK for list of package (system update) and node properties.
It should not give access to technical logs thought.
Plus correcting the access errors.

Actions

Copy link

Updated by Clark ANDRIANASOLO about 1 month ago

Related to Bug #27040: Inventory role allows to get system status logs and technical logs added

Actions

Copy link

Updated by Clark ANDRIANASOLO about 1 month ago

Status changed from New to In progress

Actions

Copy link

Updated by Clark ANDRIANASOLO about 1 month ago

Status changed from In progress to Pending technical review
Pull Request set to https://github.com/Normation/rudder/pull/6431

PR https://github.com/Normation/rudder/pull/6431

Actions

Copy link Download all files

Updated by Clark ANDRIANASOLO about 1 month ago

File clipboard-202506051548-ddp9w.png clipboard-202506051548-ddp9w.png added
File clipboard-202506051548-7hy8k.png clipboard-202506051548-7hy8k.png added
Subject changed from User with only  “Inventory” rights can access too much information to User with only  “Inventory” rights has a notification error when changing tab
Status changed from Pending technical review to New
Pull Request deleted (~~https://github.com/Normation/rudder/pull/6431~~)

Contrary to 8.2, the 8.3 disallows the inventory user to get the system compliance (and the compliance is attempted to be fetched on every tab change) :

The main problem is #27040 in 8.2, and the fix for this one in 8.3 should only be about the access

Actions

Copy link