ericholguin opened a new issue, #6985: URL: https://github.com/apache/trafficcontrol/issues/6985
<!-- ************ STOP!! ************ If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact the Apache Traffic Control Security Team at [email protected] and follow the guidelines at https://apache.org/security regarding vulnerability disclosure. - For *SUPPORT QUESTIONS*, use the #traffic-control channel on the ASF slack (https://s.apache.org/tc-slack-request) or the Traffic Control Users mailing list (send an email to [email protected] to subscribe). - Before submitting, please **SEARCH GITHUB** for a similar issue or PR * https://github.com/apache/trafficcontrol/issues * https://github.com/apache/trafficcontrol/pulls --> When current user has a role with a lower privilege level than the role it is updating itself to, will result in an Internal Server Error in Traffic Portal. In Traffic Ops this is not allowed when using the `users/{id}` endpoint however Traffic Portal uses the `user/current` endpoint when updating your self. <!-- Do not submit security vulnerabilities or support requests here - see above --> ## This Bug Report affects these Traffic Control components: <!-- delete all those that don't apply --> - Traffic Portal ## Current behavior: <!-- Describe how the bug happens --> Try updating your own role to a role with higher privileges in Traffic Portal you should see an Internal Server Error alert. ## Expected behavior: <!-- Describe what the behavior would be without the bug --> The alert should be: `"users cannot update their own role"` or something similar. ## Steps to reproduce: <!-- If the current behavior is a bug, please provide the *STEPS TO REPRODUCE* and include the applicable TC version. --> Go to Traffic Portal Login as a user with an operations role Try updating your own role to admin you should see an Internal Server Error alert. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
