Uploaded image for project: 'Blesta Core'
  1. Blesta Core
  2. CORE-5195

Update how we handle ACL permission issues in the client area

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.10.0-b2
    • Fix Version/s: 5.11.0-b1
    • Component/s: Client Interface
    • Labels:
      None

      Description

      We show the same message when accessing a page within the admin area and the client area. If you try to access something you don't have permissions to, you get the following error on a page of its own:

      You are not authorized to access that resource.

      Consider the following case:

      A client creates a contact. That contact has its own login but doesn't have permissions to "Order". The contact visits the order form (while not authenticated) and attempts to place an order. Upon logging in, they see the message "You are not authorized to access that resource.". This happens because we don't know they don't have permission because it's a public page. Once they log in, we know they shouldn't be able to access it.

      We want to handle things different for Clients/Contacts/Managers from Staff. Staff would continue to work as it does now, but if you're a Contact or Manager and you don't have permissions we will:

      1. Redirect the user to the client Dashboard.
      2. Within the Dashboard, display an error box consistent with normal errors, with a different message. The message for Contacts/Managers when an ACL permission error occurs should be:

      Your user does not have permissions to access this, please contact the primary account holder to request access.

        Activity

          People

          • Assignee:
            jonathan Jonathan Reissmueller
            Reporter:
            admin Paul Phillips
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - Not Specified
              Not Specified
              Remaining:
              Remaining Estimate - 0 minutes
              0m
              Logged:
              Time Spent - 36 minutes
              36m

                Agile