pgadmin-org / pgadmin-org/pgadmin4
Users without Manage Server permission can still add servers in Query Tool
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Describe the bug
As far as I understand the point of "Manage Server" permission is to lock down users that they could only access predefined list of servers. Unfortunately, they can still use Query Tool Workspace and connect to any known server on the environment.
To Reproduce
Steps to reproduce the behavior:
- Login with pgAdmin Administrator, go to
User Management->Permissionsand disableManage Serverpermissions fromUserrole. - Now login with pgAdmin User and go to Query Tool Workspace -> Welcome page.
- Here you can still use a form to specify any PostgreSQL server you want.
Expected behavior
Users without Manage Server permission should not be able to login to other servers in the system. Alternatively, new permission could be implemented to control just user provided servers. It could be called Connect to all servers or something like that. When disabled it would allow to connect only to servers in the Object Explorer.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in the Query Tool Workspace Welcome page with a user role that lacks Manage Server permission. Trace how the form accepts a user-provided PostgreSQL server and compare that path with the permission checks for servers in the Object Explorer. Done means unauthorized users cannot connect to arbitrary servers, with the intended permission behavior covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql, python
- Domain
- authorization, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100