Tanishq Choudhary created FINERACT-3029:
-------------------------------------------
Summary: Three read permission checks use names that don't exist
Key: FINERACT-3029
URL: https://issues.apache.org/jira/browse/FINERACT-3029
Project: Apache Fineract
Issue Type: Bug
Reporter: Tanishq Choudhary
Three read checks build a permission code that isn't in m_permission, so a role
with the real permission gets a 403. Only ALL_FUNCTIONS and ALL_FUNCTIONS_READ
pass.
||Where||Checks||Real permission||
|TemplatePopulateImportConstants.FUNDS_ENTITY_TYPE, used by 7 bulk import
templates|READ_FUNDS|READ_FUND|
|SmsCampaignApiResource.preview, the other SMS reads already use
READ_SMSCAMPAIGN|READ_SMS_CAMPAIGN|READ_SMSCAMPAIGN|
|TwoFactorConfigurationApiResource.retrieveAll|READ_TWOFACTOR_CONFIG|READ_TWOFACTOR_CONFIGURATION|
Found by comparing every validateHasReadPermission,
validateHasCreatePermission, validateHasUpdatePermission and
validateHasDeletePermission argument on develop (8e80aa6e8) with the permission
codes in the tenant changelog.
Expected: a role with the real permission passes these checks. All three fixes
are one-word changes to the resource name. I've got them locally with unit
tests that fail before the change and pass after it. I haven't run this against
a live server.
Different from FINERACT-3027, which covers the interest pause endpoints.
Five more names have no matching permission at all: READ_SURVEY,
READ_POVERTYLINE, READ_EXTERNALSERVICECONFIGURATION, READ_CREDITBUREAU and
READ_SHAREDACCOUNT. Those need a decision on whether to add a permission or
check an existing one, so they aren't part of this.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
