Code 500 during API connecting for users without full permissions
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 205
- Forks
- 129
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
where I send POST API to Mautic for users without full permissions Mautic give me code 500 and this log:
[2021-03-31 16:06:52] mautic.CRITICAL: Uncaught PHP Exception Mautic\CoreBundle\Security\Exception\PermissionNotFoundException: "Nie znaleziono zgody. 'lead:leads:newown' given." at /var/www/mautic/app/bundles/CoreBundle/Security/Permissions/CorePermissions.php line 292 {"exception":"[object] (Mautic\\CoreBundle\\Security\\Exception\\PermissionNotFoundException(code: 403): Nie znaleziono zgody. 'lead:leads:newown' given. at /var/www/mautic/app/bundles/CoreBundle/Security/Permissions/CorePermissions.php:292)"} []
Even if you select all possible options for user in "Role", the problem occurs. It disappears only when I select "full permissions" or give user administrator access.
Mautic 3.3.2
PHP 7.4.3
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing a POST API request with a user who lacks full permissions, using the Mautic 3.3.2 and PHP 7.4.3 context in the report. Read app/bundles/CoreBundle/Security/Permissions/CorePermissions.php around line 292 and trace the lead:leads:newown permission lookup. Done means the request no longer returns HTTP 500 for the described restricted role while permission checks remain enforced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100