Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ bug ]从1.7.1开始Dashboard页面用户权限出现严重bug #552

Closed
dbcmp opened this issue Nov 29, 2019 · 3 comments
Closed

[ bug ]从1.7.1开始Dashboard页面用户权限出现严重bug #552

dbcmp opened this issue Nov 29, 2019 · 3 comments
Labels
bug Something isn't working

Comments

@dbcmp
Copy link

dbcmp commented Nov 29, 2019

在提交 issue 前,请查阅以下资源,请先进行搜索来保证没有类似的 issue。
文档 | FAQ

重现步骤

1、docker方式搭建干净的1.7.1或1.7.2版本

2、超级用户登录,点击Dashboard

image

3、普通用户登录(超级用户退出)

image

4、普通用户点击Dashboard(超级用户退出)

image

5、普通用户点击Dashboard后,随便点击一个菜单,例:实例管理--实例列表(超级用户退出)

image

image

初步判断:
image
上图中cache_page设计是出于什么考虑?是否是导致这个bug的原因?

期待结果:超级用户先登录点击仪表盘退出,普通用户登录后点击仪表盘(1.7.0版本)

image

@hhyo hhyo added the bug Something isn't working label Nov 29, 2019
@hhyo
Copy link
Owner

hhyo commented Nov 29, 2019

感谢反馈,问题之前已确认是cache_page导致,使用cache_page是因为方便,不需要单独处理缓存

  • 暂时不要给Dashboard菜单权限给普通用户

其实各个菜单都有权限控制,看到也不会存在越权操作

@hhyo hhyo closed this as completed in 8b40615 Nov 29, 2019
@dbcmp
Copy link
Author

dbcmp commented Nov 29, 2019

感谢您回复,主要是我们用户多,有的页面权限是不完全控制的,比如工具插件(别的没顾上点),被群众骂惨了,临时用1.7.0的Dashboard代码覆盖1.7.2的暂时没问题了
期待最新稳定版修复bug,感谢!

@hhyo
Copy link
Owner

hhyo commented Nov 29, 2019

这个其实发现一段时间,只是感觉权限控制的挺严就没着急修,看来还是有影响,现在已经修复,周末更新一版,方便的话可使用hhyo/ archery:master 的镜像协助验证一下,已自动build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants