Uploaded image for project: 'Medici'
  1. Medici
  2. MMDB-910

enforce access control in batch operations

XMLWordPrintableJSON

    • Icon: New Feature New Feature
    • Resolution: Fixed
    • Icon: Major Major
    • 1.1
    • None
    • None
    • None

      The current behavior implements global permissions on batch operations by making it so menu items for operations the user doesn't have global permissions to are not shown.

      If the user does have permission to do a specific operation on some of the objects selected, because they are the owner of those objects, they still don't get the option to do those operations. They can still navigate to the individual dataset or collection page and take those actions, but they can't do batch actions.

      The alternative, and what this issue suggests as a resolution, is to reenable all the menu items, and return a partial failure if the user does not have permission to take the action on some of the selected set. Partial failures are already handled; and the way batch operations are implemented is kind of heterogeneous, so the implementation would have to be done in several places. shouldn't take that long, and will primarily affect BatchOperationPresenter and some of the dispatches it calls.

              futrelle Joe Futrelle (Inactive)
              futrelle Joe Futrelle (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: