geonetwork / geonetwork/core-geonetwork
[Bug] Reviewer can access admin pages
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 521
- Forks
- 515
- Avg merge
- 6d 13h
- Merged PRs (30d)
- 19
Description
Describe the bug
A reviewer can access to admin pages by url
To Reproduce
Steps to reproduce the behavior:
- Create a reviewver
- Go to admin page by url example : /geonetwork/srv/eng/admin.console#/dashboard/status
Expected behavior
we should not success to go to this url
Desktop (please complete the following information):
- Reproduce in Geonetwork 4.4.1 and 4.4.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported URL /geonetwork/srv/eng/admin.console#/dashboard/status while signed in as a reviewer, then trace the access-control entry point for the admin pages. Identify the authorization check that should deny this role and add a regression test covering the reviewer request. Done means reviewers can no longer access the admin URL while authorized administrators still can.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100