Author Topic: user adds dashlets to dashboard but when role changes, still has access to them (Read 806 times)

Mark Tompsett · February 20, 2013, 04:21:34 am

A user can add dashlets (which are restricted to specific roles) to their dashboard, but then the user is moved to a different role, which should not see these dashlets, yet the dashlets remain in their dashboard, and they can still see the data displayed in the dashlets.
The user has no access to the reports from which the dashlets were created yet they still appear in their dashboard.

This is either a bug or a missing feature, depending on your point of view, I guess.
I would argue that it is a security bug - would you agree?
If we agree that it is a bug then I will report it as such.

Mark

Donald Lobo · February 20, 2013, 07:39:12 am

what happens when you do a refresh of the dashboard cache after the role has changed?

I would classify it as a missing feature. Would be great if you can investigate and submit a patch. Seems like you'll need to implement a hook to detect for any role changes and if so reset the dashboard cache for that user

lobo

Donald Lobo · February 20, 2013, 10:26:53 am

filed an issue here:
http://issues.civicrm.org/jira/browse/CRM-11936

CiviCRM Community Forums (archive)

News:

Author Topic: user adds dashlets to dashboard but when role changes, still has access to them (Read 806 times)

Mark Tompsett

user adds dashlets to dashboard but when role changes, still has access to them

Donald Lobo

Re: user adds dashlets to dashboard but when role changes, still has access to them

Donald Lobo

Re: user adds dashlets to dashboard but when role changes, still has access to them