[
https://issues.apache.org/jira/browse/FINERACT-3029?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136445#comment-18136445
]
Sanvi Abhijit Naik commented on FINERACT-3029:
----------------------------------------------
Hi, I'd like to work on this issue and submit a PR addressing the three
incorrect read permission checks. I'll investigate the existing
permission-checking patterns, make the necessary corrections
> Three read permission checks use names that don't exist
> -------------------------------------------------------
>
> Key: FINERACT-3029
> URL: https://issues.apache.org/jira/browse/FINERACT-3029
> Project: Apache Fineract
> Issue Type: Bug
> Reporter: Tanishq Choudhary
> Priority: Minor
>
> Three read checks build a permission code that isn't in m_permission, so a
> role with the real permission gets a 403. Only ALL_FUNCTIONS and
> ALL_FUNCTIONS_READ pass.
> ||Where||Checks||Real permission||
> |TemplatePopulateImportConstants.FUNDS_ENTITY_TYPE, used by 7 bulk import
> templates|READ_FUNDS|READ_FUND|
> |SmsCampaignApiResource.preview, the other SMS reads already use
> READ_SMSCAMPAIGN|READ_SMS_CAMPAIGN|READ_SMSCAMPAIGN|
> |TwoFactorConfigurationApiResource.retrieveAll|READ_TWOFACTOR_CONFIG|READ_TWOFACTOR_CONFIGURATION|
> Found by comparing every validateHasReadPermission,
> validateHasCreatePermission, validateHasUpdatePermission and
> validateHasDeletePermission argument on develop (8e80aa6e8) with the
> permission codes in the tenant changelog.
> Expected: a role with the real permission passes these checks. All three
> fixes are one-word changes to the resource name. I checked each one with a
> unit test, not against a live server. I won't be sending a PR for this, so
> anyone can take it.
> Different from FINERACT-3027, which covers the interest pause endpoints.
> Five more names have no matching permission at all: READ_SURVEY,
> READ_POVERTYLINE, READ_EXTERNALSERVICECONFIGURATION, READ_CREDITBUREAU and
> READ_SHAREDACCOUNT. Those need a decision on whether to add a permission or
> check an existing one, so they aren't part of this.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
