Actions
Bug #2931
closed
Non-privileged user can't delete authorization tokens.
Status:
Resolved
Priority:
Normal
Assigned To:
Category:
-
Target version:
Story points:
1.0
Description
Under the following conditions
- A link exists in the database with
head_uuid=null and link_class='permission', owned by (say) admin - Non-admin user creates an ApiClientAuthorization (e.g., with the "share" button on the Workbench "show collection" page)
- Non-admin user deletes the ApiClientAuthorization (e.g., "unshare")
Result: Permission denied. "dependent: destroy" hook tries to delete all links with head_uuid=null.
Updated by Tom Clegg almost 10 years ago
- Subject changed from Workbench can't delete authorization tokens used by "share" button. to Non-privileged user can't delete authorization tokens.
- Assigned To set to Tom Clegg
Updated by Anonymous almost 10 years ago
- Status changed from New to Resolved
- % Done changed from 0 to 100
Applied in changeset arvados|commit:c7ee5e02cae78d3edff6ed393d776c4995441896.
Updated by
Actions