geonetwork / geonetwork/core-geonetwork

User administrators can update their own user to remove the user administrator profile

Open
#6,764 0 comments 0 reactions 0 assignees View on GitHub
backport 3.12.x
Dominant language
Java
Stars
521
Forks
514
Avg merge
6d 13h
Merged PRs (30d)
19

Description

**Describe the bug**
User administrator can edit and update their own users to remove the user administrator profile, that should not be allowed.

**To Reproduce**

Steps to reproduce the behavior:

1. With an Administrator user created a user with a profile User administrator.
2. Login with the User administrator user and go to the users management.
3. Edit the User administrator user, remove the user administrator profile and save the user.
4. The user is no longer displayed in the list

**Expected behavior**
User administrator user can't remove this profile from their own user configuration.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue through the users management flow described in the report, then trace the user administrator's permission checks around editing their own user. Done means a user administrator cannot remove the user administrator profile from their own account, while the existing user-management behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.