[
https://issues.apache.org/jira/browse/FINERACT-3029?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tanishq Choudhary updated FINERACT-3029:
----------------------------------------
Description:
Three read checks build a permission code that isn't in m_permission, so a role
with the real permission gets a 403. Only ALL_FUNCTIONS and ALL_FUNCTIONS_READ
pass.
||Where||Checks||Real permission||
|TemplatePopulateImportConstants.FUNDS_ENTITY_TYPE, used by 7 bulk import
templates|READ_FUNDS|READ_FUND|
|SmsCampaignApiResource.preview, the other SMS reads already use
READ_SMSCAMPAIGN|READ_SMS_CAMPAIGN|READ_SMSCAMPAIGN|
|TwoFactorConfigurationApiResource.retrieveAll|READ_TWOFACTOR_CONFIG|READ_TWOFACTOR_CONFIGURATION|
Found by comparing every validateHasReadPermission,
validateHasCreatePermission, validateHasUpdatePermission and
validateHasDeletePermission argument on develop (8e80aa6e8) with the permission
codes in the tenant changelog.
Expected: a role with the real permission passes these checks. All three fixes
are one-word changes to the resource name. I checked each one with a unit test,
not against a live server. I won't be sending a PR for this, so anyone can take
it.
Different from FINERACT-3027, which covers the interest pause endpoints.
Five more names have no matching permission at all: READ_SURVEY,
READ_POVERTYLINE, READ_EXTERNALSERVICECONFIGURATION, READ_CREDITBUREAU and
READ_SHAREDACCOUNT. Those need a decision on whether to add a permission or
check an existing one, so they aren't part of this.
was:
Three read checks build a permission code that isn't in m_permission, so a role
with the real permission gets a 403. Only ALL_FUNCTIONS and ALL_FUNCTIONS_READ
pass.
||Where||Checks||Real permission||
|TemplatePopulateImportConstants.FUNDS_ENTITY_TYPE, used by 7 bulk import
templates|READ_FUNDS|READ_FUND|
|SmsCampaignApiResource.preview, the other SMS reads already use
READ_SMSCAMPAIGN|READ_SMS_CAMPAIGN|READ_SMSCAMPAIGN|
|TwoFactorConfigurationApiResource.retrieveAll|READ_TWOFACTOR_CONFIG|READ_TWOFACTOR_CONFIGURATION|
Found by comparing every validateHasReadPermission,
validateHasCreatePermission, validateHasUpdatePermission and
validateHasDeletePermission argument on develop (8e80aa6e8) with the permission
codes in the tenant changelog.
Expected: a role with the real permission passes these checks. All three fixes
are one-word changes to the resource name. I've got them locally with unit
tests that fail before the change and pass after it. I haven't run this against
a live server.
Different from FINERACT-3027, which covers the interest pause endpoints.
Five more names have no matching permission at all: READ_SURVEY,
READ_POVERTYLINE, READ_EXTERNALSERVICECONFIGURATION, READ_CREDITBUREAU and
READ_SHAREDACCOUNT. Those need a decision on whether to add a permission or
check an existing one, so they aren't part of this.
> Three read permission checks use names that don't exist
> -------------------------------------------------------
>
> Key: FINERACT-3029
> URL: https://issues.apache.org/jira/browse/FINERACT-3029
> Project: Apache Fineract
> Issue Type: Bug
> Reporter: Tanishq Choudhary
> Priority: Minor
>
> Three read checks build a permission code that isn't in m_permission, so a
> role with the real permission gets a 403. Only ALL_FUNCTIONS and
> ALL_FUNCTIONS_READ pass.
> ||Where||Checks||Real permission||
> |TemplatePopulateImportConstants.FUNDS_ENTITY_TYPE, used by 7 bulk import
> templates|READ_FUNDS|READ_FUND|
> |SmsCampaignApiResource.preview, the other SMS reads already use
> READ_SMSCAMPAIGN|READ_SMS_CAMPAIGN|READ_SMSCAMPAIGN|
> |TwoFactorConfigurationApiResource.retrieveAll|READ_TWOFACTOR_CONFIG|READ_TWOFACTOR_CONFIGURATION|
> Found by comparing every validateHasReadPermission,
> validateHasCreatePermission, validateHasUpdatePermission and
> validateHasDeletePermission argument on develop (8e80aa6e8) with the
> permission codes in the tenant changelog.
> Expected: a role with the real permission passes these checks. All three
> fixes are one-word changes to the resource name. I checked each one with a
> unit test, not against a live server. I won't be sending a PR for this, so
> anyone can take it.
> Different from FINERACT-3027, which covers the interest pause endpoints.
> Five more names have no matching permission at all: READ_SURVEY,
> READ_POVERTYLINE, READ_EXTERNALSERVICECONFIGURATION, READ_CREDITBUREAU and
> READ_SHAREDACCOUNT. Those need a decision on whether to add a permission or
> check an existing one, so they aren't part of this.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
