geonetwork / geonetwork/core-geonetwork
User administrators can update their own user to remove the user administrator profile
- Dominant language
- Java
- Stars
- 521
- Forks
- 514
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 19
Description
**Describe the bug**
User administrator can edit and update their own users to remove the user administrator profile, that should not be allowed.
**To Reproduce**
Steps to reproduce the behavior:
1. With an Administrator user created a user with a profile User administrator.
2. Login with the User administrator user and go to the users management.
3. Edit the User administrator user, remove the user administrator profile and save the user.
4. The user is no longer displayed in the list
**Expected behavior**
User administrator user can't remove this profile from their own user configuration.
Contributor guide
Research direction
Start by reproducing the issue through the users management flow described in the report, then trace the user administrator's permission checks around editing their own user. Done means a user administrator cannot remove the user administrator profile from their own account, while the existing user-management behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100