Graylog2 / Graylog2/graylog2-server

Decorator permissions should'nt be conditioned by STREAM_EDIT

Open
#2,794 2 comments 0 reactions 0 assignees View on GitHub
feature improvement triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

As a stream reader i would like to manipulate decorators since i have appropriate read/create/delete stream's decorator permissions.
## Current Behavior

As i'm simple stream reader, any decorator actions are forbidden.
## Possible Solution

If stream permission have to be check, for me only READ matters. As:
- we don't speak about stream lifecycle, i can't delete/edit stream
- we speak about custom fields useful for read aspect.
- i have appropriate decorators permissions.
## Steps to Reproduce (for bugs)
1. Create a stream
2. As administrator, give to user decorators:{stream_id}:read/edit/create stream:{stream_id}:read
3. As user, try to create decorators
## Your Environment
- Graylog Version: 2.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.