Issues

Select view

  • Select search mode

 
50 of 107

Hiding and enabling Dropbox gives full set of permissions to non-maintainer roles

Fixed

Description

This issue wasn't happening in 20.1 but it is happening in 20.3 and 20.x. Just hiding and making visible the Dropbox tool gives to non-maintainer roles all permissions over Dropbox. Locking and unlocking the tool also does the same.

We suspect that this is related to the changes of SAK-43149, but we are still investigating.

I'm going to paste a query in the comments to detect incorrect permissions in database.

Attachments

1

Details

Priority

Affects versions

Fix versions

22 Status

Verified

Components

Assignee

Reporter

Created September 14, 2021 at 5:53 AM
Updated February 1, 2022 at 12:12 AM
Resolved October 7, 2021 at 8:45 AM

Activity

AustinJanuary 31, 2022 at 6:36 PM

Also we have about 2000 records where the realm is set to a dropbox function_key with a function_name of

”dropbox.own | dropbox.maintain | dropbox.maintain.own.groups”

 

 

is that normal? should we delete the sakai_realm_rl_fn records using that function? should we delete that function key from sakai_realm_function?

AustinJanuary 31, 2022 at 6:18 PM
Edited

sorry, about that. I didn’t see your first comment because of the new look of the “view 11 remaining older comments” button

 

Thanks!

Daniel MerinoJanuary 31, 2022 at 9:08 AM

The MySql query I talked about is in the first comment that I wrote in September 14th in this JIRA. After it, you have the Oracle version of my query from Brian Jones.

Maybe the last query of Marty Soupcoff is better though, I haven’t compared them.

Marty Soupcoff (not active in Sakai community anymore)January 29, 2022 at 3:15 PM

Sam created bulk of below query for us and then I tweaked a bit as needed. We set up on a cron and anytime it found one I’d manually go into realms and fix.

AustinJanuary 29, 2022 at 2:41 AM

I'm going to paste a query in the comments to detect incorrect permissions in database

Do you have this query? I also, have one (for the SELECT), but I’d like to compare it with what you came up with.

Do you also have one to delete the bad records? We’re no longer using the Admin Permissions tool since it was said on the sakai-dev forums that the performance is bad and a direct reply from another developer said to stop using it.