READ_ONLY user access problem

[mustafaboleken]

Short description

When using the READ_ONLY user with the scope of everything, the user sees the new user page but has no access to use so it should be invisible to the READ_ONLY user.

Environment

• Ant Media Server version: v2.4.3

Steps to reproduce

1. Sign in with READ_ONLY user who has the scope of everything.
2. Go to settings -> users -> new user
3. Fill out the form and press the save button.

Expected behavior

Adding the new user button shouldn't be visible because the READ_ONLY user doesn't have access to add a new user.

Actual behavior

READ_ONLY user can open a new user page and fill the areas. After submitting a form, it takes unauthorized error.