Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

User can still fill out questionnaire even though it's not row level secured #7531

Open
tommydeboer opened this issue Jul 11, 2018 · 5 comments
Open

User can still fill out questionnaire even though it's not row level secured #7531

tommydeboer opened this issue Jul 11, 2018 · 5 comments
Labels
7.1 bug mod:questionnaires
Milestone
Backlog First

Comments

@tommydeboer
Copy link
Collaborator

How to Reproduce

  1. Add a group c6

  2. Upload this questionnaire

  3. Make a user member of the C6_VIEWER role

  4. Give role C6_VIEWER permission to EDIT c6_questionnaire

  5. Log in as admin and start the questionnaire

  6. Observe that the questionnaire won't start because No row level security enabled for questionnaire, this is not allowed

  7. Log in as the user and start the questionnaire

Expected behavior

The questionnaire won't start.

Observed behavior

The user can fill out the questionnaire anyway.
@tommydeboer tommydeboer added this to the Sprint 122 milestone Jul 11, 2018
@ConnorStroomberg
Copy link
Contributor

Related to As group manager I want questionnaires to be row-level secured by default http://wiki.gcc.rug.nl/ticket/5970

@mswertz mswertz modified the milestones: Sprint 122, Sprint 123 Jul 16, 2018
@dennishendriksen dennishendriksen self-assigned this Jul 16, 2018
@dennishendriksen
Copy link
Contributor

Cannot reproduce:
image
@tommydeboer can you double check with current master?

@tommydeboer tommydeboer removed their assignment Jul 17, 2018
@tommydeboer
Copy link
Collaborator Author

tommydeboer commented Jul 17, 2018 •
edited

@dennishendriksen The description is wrong, sorry. It happens when:

  • you turn off RLS
  • let a user edit
  • turn on RLS
  • user can continue editing because the RLS check is done at the start of a questionnaire

@dennishendriksen
Copy link
Contributor

In that case I think we can fix it after 7.0

@tommydeboer
Copy link
Collaborator Author

Agreed

@tommydeboer tommydeboer removed this from the Sprint 123 milestone Jul 17, 2018
@LuukDijkhuis LuukDijkhuis added this to the Backlog First milestone Aug 8, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
7.1 bug mod:questionnaires
Projects
None yet
Milestone
Backlog First
Development

No branches or pull requests
5 participants
@mswertz @ConnorStroomberg @dennishendriksen @tommydeboer @LuukDijkhuis