DependencyTrack / DependencyTrack/dependency-track
Bug : Give view permission to specific team to a specific project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
This is just a little bug, but it is one :)
I discovered in the API that we were able to limit users to particular projects.
So i created an ACL like that :
```
curl --location --request PUT 'http://../api/v1/acl/mapping' \
--header 'x-api-key: bS5ypdSN9ElVx4DDeo4A931WXMmE9ngV' \
--header 'Content-Type: application/json' \
--data-raw '{
"team": "5cb65538-977d-4b7d-94a1-49e0b03d5f50",
"project": "57f25503-9abe-48df-aa81-5e01f3b43c5e"
}'
```
Then i gave the permission to the team and i logged in with the user.
I was not limited to the project created with the ACL.
After that i discovered that the interface was purposing that too, and i checked the "Enable portfolio access control (beta)".
And it is after that, that i was limited to my project.
So i think, that creating an acl should activate the "Enable portfolio access control (beta)" or should say "You don't have activated the portfolio..."
Contributor guide
Assessment
This issue has not been assessed yet.