Graylog2 / Graylog2/graylog2-server

Incorrect Permission for Deleteing a Stream Causes Backend Permission Error

Open
#23,770 1 comment 0 reactions 0 assignees View on GitHub
bug frontend
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

If a user does not have the streams:delete or the streams:delete: permission, then the 'Delete this stream' menu item in the streams overview should not be visible.

## Current Behavior

When a user does not have the streams:delete or the streams:delete: permission, the 'Delete this stream' menu item in the streams overview is visible. Clicking on the 'Delete this stream' item causes a backend permission error.

## Possible Solution

Adjust the frontend permissions to check for a 'streams:delete' permission instead of a 'streams:edit' permission.

## Steps to Reproduce (for bugs)

1. Create a user with the 'Reader' Role + 'streams:create' and 'indexsets:read' permissions, but without the 'streams:delete' permission.
2. Login as said user and navigate to 'Streams'
3. Click the 'Create stream' button and fill in the stream title and index set
4. Click 'Create stream'
5. Click the 'More' button on the stream you just created
6. Click the 'Delete this stream' menu item

## Context

Align permissions models between frontend and backend to avoid user confusion.

## Your Environment

* Graylog Version: Graylog 6.3.4

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.