RocketChat / RocketChat/Rocket.Chat
An admin user is able to lock themselves out of the permissions page
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
I was attempting to remove the view privilege permission from all admins, and add it to myself as owner. As soon as I unchecked the permission for admin, I (and all other admins) were locked out of the page, so now no-one can set the permissions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the admin permissions page and reproduce the described sequence: remove the view privilege from admins while assigning it to yourself as owner. Trace the permission update flow and determine how to prevent the page from becoming inaccessible to every administrator; done means the change is safely applied and the page remains recoverable and usable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100