Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply Rights check on addDefaultWhere to allow list all ProjectTasks in RestAPI #17168

Draft
wants to merge 1 commit into
base: 10.0/bugfixes
Choose a base branch
from

Conversation

fgendorf
Copy link

Using RestAPI to list all subitems from Project, it the subitem is ProjectTask only return values where I am Task Team member, but if I have all Rights on projects I want see all Tasks.

Q A
Bug fix? yes
New feature? no
BC breaks? no
Deprecations? no

@cconard96
Copy link
Contributor

This is the currently expected behavior as the only way to search project tasks in the web UI is through the "My tasks" button on the project page(s). To handle that case, the restrictions were added directly to the Search engine which has the side effect of affecting the API.

@fgendorf fgendorf marked this pull request as draft May 23, 2024 12:01
Copy link
Member

@cedric-anne cedric-anne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing this will result, for people that have the right to see all tasks, in viewing all tasks of all projects in the My tasks views instead of viewing only their tasks.

Due to the way the projects and the project tasks team management is done in GLPI, I am not sure it is possible to add a search option that would permit to replace this default WHERE condition by a default Team members contains myself criteria. If it is possible, then maybe it would be a way to solve this problem.

Anyway, changing this should not be done on GLPI 10.0, as it would probably have unexpected side effects and as it may be considered as a too important change for a bugfix version by some end users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants