Skip to content

/collection/{slug}/estimation: admin should have access to everyone's estimation page #889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
0pdd opened this issue Jun 21, 2018 · 1 comment
Closed

/collection/{slug}/estimation: admin should have access to everyone's estimation page #889

0pdd opened this issue Jun 21, 2018 · 1 comment
Assignees
@php-coder
Labels
area/security techdebt
Milestone
0.4

Comments

@0pdd
Copy link

0pdd commented Jun 21, 2018 •
edited by php-coder
Loading

The puzzle 884-61920ac4 from #884 has to be resolved:

mystamps/src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java

Line 92 in 9287473

// @todo #884 /collection/{slug}/estimation: only owner should have access to estimation page

The puzzle was created by Slava Semushin on 20-Jun-18.
@0pdd 0pdd added the techdebt label Jun 21, 2018
0pdd referenced this issue Jun 21, 2018
@php-coder
/collection/{slug}/estimation: add a page with prices of the series i…
9287473 
…n a collection.

Fix #884
This was referenced Jun 21, 2018
Closed
Closed
@php-coder php-coder added this to the 0.4 milestone Jun 21, 2018
@php-coder php-coder self-assigned this May 25, 2019
@php-coder php-coder pinned this issue Jun 3, 2019
@php-coder php-coder changed the title /collection/{slug}/estimation: only owner should have access to estimation page /collection/{slug}/estimation: admin should have access to everyone's estimation page Jun 15, 2019
@php-coder
Copy link
Owner

At this moment the task is already solved: "only owner should have access to estimation page" statement is true because in #891 we restricted the access to the service method by only collection's owner. Even if the access on the page-level aren't so strict, the page can't be opened anyway because the service method has a stricter protection. See spring-projects/spring-security#6948 for details.

But the access still needs to be altered to allow admin access to everyone's page. This should simplify debug when it will be required. So, I've edited the issue's title to reflect that.

php-coder added a commit that referenced this issue Jun 15, 2019
@php-coder
style(collection/estimation/access.robot): fix test case name.
83ee726 
Correction for d429810 commit.

Addressed to #889

No functional changes.

[skip ci]
@php-coder php-coder unpinned this issue Jun 15, 2019
@php-coder php-coder mentioned this issue Jan 31, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@php-coder php-coder

Labels
area/security techdebt
Projects
None yet
Milestone
0.4
Development

No branches or pull requests
2 participants
@php-coder @0pdd