User privileges

A user with the following privileges:

is able to enter the "Configuration" tab and can also edit the maps to which access was granted. I think it should be possible to create users that only have view permissions and cannot edit something.

Are you sure you are logged in as the user with the privileges shown above?

When I try it such user can:

• enter configuration tab, but is unable to save the data
• can see projects, can even click the edit button (maybe this should be disabled), but when he tries to save there is a message:

Access denied.
Please login as a different user or ask your administrator to change the permissions to access this resource.

Yes, you are correct ("Access denied") but I already found it confusing that such a user has these view options. This error did not appear in the configuration tab ("save" seemed to be possible, but I am not sure if it was really saved or only looked like it was saved). As you stated, I would disable that a users can see the projects etc.

Can you confirm that user without "Manage configuration" privilege can change and save configuration item?

It shouldn't happen, and I cannot reproduce it on my side..

It seems that saving does not work (as you stated). But in contrast to editing a map, an error message does not appear in the configuration tab. I think the best way is to just disable both views.

created branch 441-user-privileges

mentioned in merge request !333 (merged)

mentioned in commit 50834d41

closed via merge request !333 (merged)