dhis2-devs team mailing list archive

["Dapo Adejumo" <dapsyjorge@xxxxxxxxx>]

Hi Harding,
That is right, this unusual behavior started in 2.18....
A bug was reported on this a while back.
See bug and progress here

https://bugs.launchpad.net/dhis2/+bug/1453569



………………………………………
Regards,
Dapo Adejumo
+2348033683677
Skype : dapojorge

-----Original Message-----
From: Dhis2-devs
[mailto:dhis2-devs-bounces+dapsyjorge=gmail.com@xxxxxxxxxxxxxxxxxxx] On
Behalf Of hardingt
Sent: 13 July, 2015 6:00 PM
To: dhis2-devs@xxxxxxxxxxxxxxxxxxx
Subject: [Dhis2-devs] [Bug 1474060] [NEW] Users able to delete dashboard
items without authorization

Public bug reported:

Hello Devs,

Saw this occur on a production 2.18 machine by reading the logs, Confirmed
this on 2.19 using the SL demo site

Steps to recreate:
1. Create dashboard with administrator account 2. Set public as 'can view'
3. Add dashboard item, in my case it was a pivot table 4. Log in with user
with the following rights:
- Add/Update Data Value
- Run validation
- See Browser Cache Cleaner module
- See Dashboard integration module
- See Data Entry module
- See Data Visualizer module
- See Event Visualizer module
- See GIS module
- See Pivot Table module
- See Report module
- See Validation Rule module
5. Navigate to dashboard created in Step 1, click remove on any dashboard
item
- Note, it usually takes a page reload to reflect the results of this
action, making it look like nothing happened until the refresh

You should find that the dashboard item(s) is no longer there.

Here is the relevant section of the log from the production 2.18 system:
* INFO  2015-07-10 18:59:16,625 '[redacted]' delete
org.hisp.dhis.dashboard.DashboardItem, uid: ov1BR9Hxj0z (AuditLogUtil.java
[http-bio-8080-exec-276])
* INFO  2015-07-10 18:59:16,638 '[redacted]' update denied
org.hisp.dhis.dashboard.Dashboard, name: Principaux, uid: NYmDyNmCqG6
(AuditLogUtil.java [http-bio-8080-exec-276])

You'll notice the dashboard item was removed, but the subsequent step to
update the dashboard was denied. As user with proper authority will cause
the following entries:

* INFO  2015-07-12 17:18:28,794 'timharding' delete
org.hisp.dhis.dashboard.DashboardItem, uid: P1XHv9Dxfsn (AuditLogUtil.java
[http-bio-8080-exec-11])
* INFO  2015-07-12 17:18:28,803 'timharding' update
org.hisp.dhis.dashboard.Dashboard, name: Baiap Health Centre, uid:
T7WL4dirz1D (AuditLogUtil.java [http-bio-8080-exec-11])

We'd like it so that the users can see the dashboard but are unable to edit
the contents. Please let me know if you need any additional info to sort
this one out. Thanks!

** Affects: dhis2
     Importance: Undecided
         Status: New

--
You received this bug notification because you are a member of DHIS 2
developers, which is subscribed to DHIS.
https://bugs.launchpad.net/bugs/1474060

Title:
  Users able to delete dashboard items without authorization

Status in DHIS:
  New

Bug description:
  Hello Devs,

  Saw this occur on a production 2.18 machine by reading the logs,
  Confirmed this on 2.19 using the SL demo site

  Steps to recreate:
  1. Create dashboard with administrator account
  2. Set public as 'can view'
  3. Add dashboard item, in my case it was a pivot table
  4. Log in with user with the following rights:
  - Add/Update Data Value
  - Run validation
  - See Browser Cache Cleaner module
  - See Dashboard integration module
  - See Data Entry module
  - See Data Visualizer module
  - See Event Visualizer module
  - See GIS module
  - See Pivot Table module
  - See Report module
  - See Validation Rule module
  5. Navigate to dashboard created in Step 1, click remove on any dashboard
item
  - Note, it usually takes a page reload to reflect the results of this
action, making it look like nothing happened until the refresh

  You should find that the dashboard item(s) is no longer there.

  Here is the relevant section of the log from the production 2.18 system:
  * INFO  2015-07-10 18:59:16,625 '[redacted]' delete
org.hisp.dhis.dashboard.DashboardItem, uid: ov1BR9Hxj0z (AuditLogUtil.java
[http-bio-8080-exec-276])
  * INFO  2015-07-10 18:59:16,638 '[redacted]' update denied
org.hisp.dhis.dashboard.Dashboard, name: Principaux, uid: NYmDyNmCqG6
(AuditLogUtil.java [http-bio-8080-exec-276])

  You'll notice the dashboard item was removed, but the subsequent step
  to update the dashboard was denied. As user with proper authority will
  cause the following entries:

  * INFO  2015-07-12 17:18:28,794 'timharding' delete
org.hisp.dhis.dashboard.DashboardItem, uid: P1XHv9Dxfsn (AuditLogUtil.java
[http-bio-8080-exec-11])
  * INFO  2015-07-12 17:18:28,803 'timharding' update
org.hisp.dhis.dashboard.Dashboard, name: Baiap Health Centre, uid:
T7WL4dirz1D (AuditLogUtil.java [http-bio-8080-exec-11])

  We'd like it so that the users can see the dashboard but are unable to
  edit the contents. Please let me know if you need any additional info
  to sort this one out. Thanks!

To manage notifications about this bug go to:
https://bugs.launchpad.net/dhis2/+bug/1474060/+subscriptions

_______________________________________________
Mailing list: https://launchpad.net/~dhis2-devs
Post to     : dhis2-devs@xxxxxxxxxxxxxxxxxxx
Unsubscribe : https://launchpad.net/~dhis2-devs
More help   : https://help.launchpad.net/ListHelp