Graylog2 / Graylog2/graylog2-server
Incorrect Permission for Deleteing a Stream Causes Backend Permission Error
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
If a user does not have the streams:delete or the streams:delete: permission, then the 'Delete this stream' menu item in the streams overview should not be visible.
## Current Behavior
When a user does not have the streams:delete or the streams:delete: permission, the 'Delete this stream' menu item in the streams overview is visible. Clicking on the 'Delete this stream' item causes a backend permission error.
## Possible Solution
Adjust the frontend permissions to check for a 'streams:delete' permission instead of a 'streams:edit' permission.
## Steps to Reproduce (for bugs)
1. Create a user with the 'Reader' Role + 'streams:create' and 'indexsets:read' permissions, but without the 'streams:delete' permission.
2. Login as said user and navigate to 'Streams'
3. Click the 'Create stream' button and fill in the stream title and index set
4. Click 'Create stream'
5. Click the 'More' button on the stream you just created
6. Click the 'Delete this stream' menu item
## Context
Align permissions models between frontend and backend to avoid user confusion.
## Your Environment
* Graylog Version: Graylog 6.3.4
Contributor guide
Assessment
This issue has not been assessed yet.