[Bug report] Non-admin users can directly use links belongs to the administration page to access some administrative functions.
Open
@hzy46 is already working on this.
Since Feb 4, 2021.
bug
- Dominant language
- JavaScript
- Stars
- 2.7k
- Forks
- 554
- Avg merge
- 20h 42m
- Merged PRs (30d)
- 14
Description
Organization Name: Fuzhou University.
Short summary about the issue/question:
Continuing to explore issue 5203, I found that Non-admin users can directly use links belongs to the administration page to access some administrative functions.
Brief what process you are following:
- Log in to a non-admin account.
- Open any of the links: https://IP/dashboard.html, https://IP/cluster-view/hardware.html, https://IP/cluster-view/k8s.html, https://IP/user-view.html.
- The administration pages are opened.
How to reproduce it:
- Log in to a non-admin account.
- Open any of the links: https://IP/dashboard.html, https://IP/cluster-view/hardware.html, https://IP/cluster-view/k8s.html, https://IP/user-view.html.
- The administration pages are opened.
OpenPAI Environment:
- OpenPAI version: v1.4.1
- Cloud provider or hardware configuration:
- OS (e.g. from /etc/os-release):
- Kernel (e.g.
uname -a): - Hardware (e.g. core number, memory size, storage size, GPU type etc.):
- Others:
Anything else we need to know:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.