Project

General

Profile

Actions

Bug #15790

open

[Workbench2] Non-admin users can access admin pages via urls

Added by Eric Biagiotti almost 3 years ago. Updated over 2 years ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
Workbench2
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Story points:
-
Release relationship:
Auto

Description

Your token is the same so you can only see data you have access to and perform operations the API lets you. For example, I was able to delete my links, and create a group, but I couldn't make myself an admin.

Before routing to admin pages, we should be checking that the current user is an admin.

Actions #1

Updated by Eric Biagiotti almost 3 years ago

  • Description updated (diff)
Actions #2

Updated by Eric Biagiotti almost 3 years ago

  • Description updated (diff)
Actions #3

Updated by Peter Amstutz over 2 years ago

  • Release set to 20
Actions

Also available in: Atom PDF