Settings service user can list other peoples assignments
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 106
Description
## Context
oCIS version: v2.0.0-rc.1
## Issue
A normal user can list other users assignments. In this case Einstein can list the admins assignments:
```
curl -k -s -u einstein:relativity -X POST 'https://localhost:9200/api/v0/settings/assignments-list' -d '{"account_uuid":"be65710a-bced-465e-9e1a-72ff269de8ee"}' | jq .
{
"assignments": [
{
"id": "30879be8-bb6f-4248-9188-df3ef6a772f7",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "f03dacd1-314b-4561-8654-6e729555324a",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "98dad15a-46aa-4302-9c41-6e3d6d4f0813",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "94a64f94-1219-46fb-b950-fd1487f453ee",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
}
]
}
```
## Expected
I don't know right now if there are valid cases where this would make sense but intuitively I'd say that this should be prohibited.
Contributor guide
Assessment
This issue has not been assessed yet.