dhis2-devs team mailing list archive

[Timothy Harding <tharding@xxxxxxxxxxxxxx>]

Public bug reported:

This seems familiar to #1230385
https://bugs.launchpad.net/bugs/1230385

The org unit tree in the hierarchy tree (shown in various apps such as
the org unit editor or data entry app) will often misbehave for
restricted users and show the entire OU tree from the root level down.
I've seen this in production systems for very restricted "data entry
only" accounts, to super users assigned only to one OU on test systems.
I'm having trouble nailing down the exact steps to reproduce, but I've
seen it enough times now that it wasn't an isolated event. The only way
to get it to reset it seems is to both reset the browser cache (the hard
way), unassigned that user from the OU, save, and reassign that user to
their OU.

One thing I also notice is if you hop into the API, you can get a full
listing of OU units regardless of the one you are assigned. Certain use
cases consider the OU tree as sensitive data, so should every user have
access to the entire tree via the API?

** Affects: dhis2
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of DHIS 2
developers, which is subscribed to DHIS.
https://bugs.launchpad.net/bugs/1549386

Title:
  User Can see Org Units not assigned to their user

Status in DHIS:
  New

Bug description:
  This seems familiar to #1230385
  https://bugs.launchpad.net/bugs/1230385

  The org unit tree in the hierarchy tree (shown in various apps such as
  the org unit editor or data entry app) will often misbehave for
  restricted users and show the entire OU tree from the root level down.
  I've seen this in production systems for very restricted "data entry
  only" accounts, to super users assigned only to one OU on test
  systems. I'm having trouble nailing down the exact steps to reproduce,
  but I've seen it enough times now that it wasn't an isolated event.
  The only way to get it to reset it seems is to both reset the browser
  cache (the hard way), unassigned that user from the OU, save, and
  reassign that user to their OU.

  One thing I also notice is if you hop into the API, you can get a full
  listing of OU units regardless of the one you are assigned. Certain
  use cases consider the OU tree as sensitive data, so should every user
  have access to the entire tree via the API?

To manage notifications about this bug go to:
https://bugs.launchpad.net/dhis2/+bug/1549386/+subscriptions