• Type: Improvement
• Resolution: Unresolved
• Priority: Major
• Fix Version/s: 2.LATER
• Affects Version/s: 2.8.8
• Component/s: Other
• Labels:

  None

1. 

   screenshot-1.png

   161 kB

   01/Mar/23 15:03

2. 

   screenshot-2.png

   156 kB

   01/Mar/23 15:05

[WORKSPACES-1460] Unable to limit statistics page access

Collapse comment: Laurence Aumeunier added a comment - 05/Apr/23 11:51, Edited by Laurence Aumeunier - 28/Apr/23 11:26

Laurence Aumeunier added a comment - 05/Apr/23 11:51 - edited

This is a normal behavior, all project's managers have access to this page. Members not.

Indeed, there is a access controller which give automatically access to the page for project's manager (ReportsPageAccessController)

Your manager is ALLOWED by this access controller and DENIED by your profile affectations but for connected users only, so ALLOWED wins.

To disable access to report page, you have 2 choices:

• Untag "Statistiques" page: the page keeps accessible by url but it will be not visible in user menu
• or disable access for each users or groups (not only for any connected users)

As improvment, ReportsPageAccessController could be reviewed, to not be based on manager status but based on a specific right (to add to admin profiles)
So by default a manager will have not access to report page anymore.

 

 

Expand comment: Laurence Aumeunier added a comment - 05/Apr/23 11:51, Edited by Laurence Aumeunier - 28/Apr/23 11:26

Laurence Aumeunier added a comment - 05/Apr/23 11:51 - edited This is a normal behavior, all project's managers have access to this page. Members not. Indeed, there is a access controller which give automatically access to the page for project's manager (ReportsPageAccessController) Your manager is ALLOWED by this access controller and DENIED by your profile affectations but for connected users only, so ALLOWED wins. To disable access to report page, you have 2 choices: Untag "Statistiques" page: the page keeps accessible by url but it will be not visible in user menu or disable access for each users or groups (not only for any connected users) As improvment, ReportsPageAccessController could be reviewed, to not be based on manager status but based on a specific right (to add to admin profiles) So by default a manager will have not access to report page anymore.