RocketChat / RocketChat/Rocket.Chat

[Bug] admin/info route renders error loading pages for "user" role users

Open
#21,216 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

admin/info route for "user" roles renders error loading pages instead of "you are not authorized to view this page".

Steps to reproduce:
  1. login as "user" role user
  2. navigate to http://x.x.x/admin/info
Expected behavior:

the response must be you are not authorized to view this page

Screenshot from 2021-03-20 15-53-33

Actual behavior:

Screenshot from 2021-03-20 15-56-12

Server Setup Information:
  • Version of Rocket.Chat Server: 3.13.0-develop
  • Operating System: linux
  • Deployment Method: tar
  • Number of Running Instances: 1
  • DB Replicaset Oplog: Enabled
  • NodeJS Version: 12.18.4 - x64
  • MongoDB Version: 4.2.8
Client Setup Information
  • Desktop App or Browser Version: 88.0.4324.182
  • Operating System: Ubuntu 20.04
Additional context

the actual behaviour should only happen if there's an error while getting responses but the API throws an error for the "user" role type which has been caught by the side effect to re-render the component.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the admin/info route and trace how its API response is handled for a user-role account, focusing on the side effect that re-renders the component after an error. Reproduce the route with a user role, then verify that an authorization failure displays the unauthorized message instead of the error-loading page.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authorization, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.