mirror of
https://github.com/Unleash/unleash.git
synced 2024-10-14 20:06:41 +02:00
e1b7cfd8dd
## Background In #6380 we fixed a privilege escalation bug that allowed members of a project that had permission to add users to the project with roles that had a higher permission set than themselves. The PR linked essentially constricts you only be able to assign users to roles that you possess yourself if you are not an Admin or Project owner. This fix broke expectations for another customer who needed to have a project owner without the DELETE_PROJECT permission. The fix above made it so that their custom project owner role only was able to assign users to the project with the role that they posessed. ## Fix Instead of looking directly at which role the role granter has, this PR addresses the issue by making the assessment based on the permission sets of the user and the roles to be granted. If the granter has all the permissions of the role being granted, the granter is permitted to assign the role. ## Other considerations The endpoint to get roles was changed in this PR. It previously only retrieved the roles that the user had in the project. This no-longer makes sense because the user should be able to see other project roles than the one they themselves hold when assigning users to the project. The drawback of returning all project roles is that there may be a project role in the list that the user does not have access to assign, because they do not hold all the permissions required of the role. This was discussed internally and we decided that it's an acceptable trade-off for now because the complexities of returning a role list based on comparing permissions set is not trivial. We would have to retrieve each project role with permissions from the database, and run the same in-memory check against the users permission to determine which roles to return from this endpoint. Instead we opted for returning all project roles and display an error if you try to assign a role that you do not have access to. ## Follow up When this is merged, there's no longer need for the frontend logic that filters out roles in the role assignment form. I deliberately left this out of the scope for this PR because I couldn't wrap my head around everything that was going on there and I thought it was better to pair on this with @chriswk or @nunogois in order to make sure we get this right as the logic for this filtering seemed quite complex and was touching multiple different components. --------- Co-authored-by: Fredrik Strand Oseberg <fredrikstrandoseberg@Fredrik-sin-MacBook-Pro.local>
95 lines
1.4 KiB
Plaintext
95 lines
1.4 KiB
Plaintext
node_modules
|
|
lerna-debug
|
|
npm-debug
|
|
.DS_Store
|
|
/dist
|
|
.vscode
|
|
|
|
# Logs
|
|
logs
|
|
*.log
|
|
|
|
# Runtime data
|
|
pids
|
|
*.pid
|
|
*.seed
|
|
|
|
# Directory for instrumented libs generated by jscoverage/JSCover
|
|
lib-cov
|
|
|
|
# Coverage directory used by tools like istanbul
|
|
# coverage
|
|
coverage/lcov-report
|
|
|
|
# Compiled binary addons (http://nodejs.org/api/addons.html)
|
|
build/Release
|
|
|
|
# liquibase stuff
|
|
/sql
|
|
unleash-db.jar
|
|
unleash-server.tar.gz
|
|
|
|
# idea stuff:
|
|
.idea/*
|
|
|
|
.vagrant/
|
|
|
|
# Visual Studio Code
|
|
jsconfig.json
|
|
typings
|
|
.nyc_output
|
|
|
|
# We use yarn.lock
|
|
package-lock.json
|
|
|
|
# Website stuff
|
|
/website/build
|
|
/website/backers.json
|
|
/website/node_modules
|
|
/website/translated_docs
|
|
/website/i18n/*
|
|
.env
|
|
|
|
# Ignore frontend build
|
|
frontend/build
|
|
|
|
# Ignore orval apis
|
|
frontend/src/openapi/apis
|
|
frontend/src/openapi/index.ts
|
|
|
|
# Generated docs
|
|
website/docs/reference/api/**/sidebar.js
|
|
website/docs/reference/api/**/**.info.mdx
|
|
website/docs/generated
|
|
reports/jest-junit.xml
|
|
|
|
# Yarn (https://yarnpkg.com/getting-started/qa#which-files-should-be-gitignored)
|
|
.pnp.*
|
|
.yarn/*
|
|
!.yarn/patches
|
|
!.yarn/plugins
|
|
!.yarn/releases
|
|
!.yarn/sdks
|
|
!.yarn/versions
|
|
frontend/.yarn/*
|
|
!frontend/.yarn/patches
|
|
!frontend/.yarn/plugins
|
|
!frontend/.yarn/releases
|
|
!frontend/.yarn/sdks
|
|
!frontend/.yarn/versions
|
|
|
|
docker/.yarn/*
|
|
!docker/.yarn/patches
|
|
!docker/.yarn/plugins
|
|
!docker/.yarn/releases
|
|
!docker/.yarn/sdks
|
|
!docker/.yarn/versions
|
|
|
|
website/.yarn/*
|
|
!website/.yarn/patches
|
|
!website/.yarn/plugins
|
|
!website/.yarn/releases
|
|
!website/.yarn/sdks
|
|
!website/.yarn/versions
|
|
|