pgadmin-org / pgadmin-org/pgadmin4

Users without Manage Server permission can still add servers in Query Tool

Open
#9,232 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Describe the bug

As far as I understand the point of "Manage Server" permission is to lock down users that they could only access predefined list of servers. Unfortunately, they can still use Query Tool Workspace and connect to any known server on the environment.

To Reproduce

Steps to reproduce the behavior:

  1. Login with pgAdmin Administrator, go to User Management -> Permissions and disable Manage Server permissions from User role.
  2. Now login with pgAdmin User and go to Query Tool Workspace -> Welcome page.
  3. Here you can still use a form to specify any PostgreSQL server you want.

Expected behavior

Users without Manage Server permission should not be able to login to other servers in the system. Alternatively, new permission could be implemented to control just user provided servers. It could be called Connect to all servers or something like that. When disabled it would allow to connect only to servers in the Object Explorer.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in the Query Tool Workspace Welcome page with a user role that lacks Manage Server permission. Trace how the form accepts a user-provided PostgreSQL server and compare that path with the permission checks for servers in the Object Explorer. Done means unauthorized users cannot connect to arbitrary servers, with the intended permission behavior covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, python
Domain
authorization, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.