Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[ bug ]从1.7.1开始Dashboard页面用户权限出现严重bug #552

Closed
dbcmp opened this issue Nov 29, 2019 · 3 comments
Closed

[ bug ]从1.7.1开始Dashboard页面用户权限出现严重bug #552

dbcmp opened this issue Nov 29, 2019 · 3 comments
Labels
bug Something isn't working

Comments

@dbcmp
Copy link

dbcmp commented Nov 29, 2019

在提交 issue 前,请查阅以下资源,请先进行搜索来保证没有类似的 issue。
文档 | FAQ

重现步骤

1、docker方式搭建干净的1.7.1或1.7.2版本

2、超级用户登录,点击Dashboard

image

3、普通用户登录(超级用户退出)

image

4、普通用户点击Dashboard(超级用户退出)

image

5、普通用户点击Dashboard后,随便点击一个菜单,例:实例管理--实例列表(超级用户退出)

image

image

初步判断:
image
上图中cache_page设计是出于什么考虑?是否是导致这个bug的原因?

期待结果:超级用户先登录点击仪表盘退出,普通用户登录后点击仪表盘(1.7.0版本)

image

@hhyo hhyo added the bug Something isn't working label Nov 29, 2019
@hhyo
Copy link
Owner

hhyo commented Nov 29, 2019

感谢反馈,问题之前已确认是cache_page导致,使用cache_page是因为方便,不需要单独处理缓存

  • 暂时不要给Dashboard菜单权限给普通用户

其实各个菜单都有权限控制,看到也不会存在越权操作

@hhyo hhyo closed this as completed in 8b40615 Nov 29, 2019
@dbcmp
Copy link
Author

dbcmp commented Nov 29, 2019

感谢您回复,主要是我们用户多,有的页面权限是不完全控制的,比如工具插件(别的没顾上点),被群众骂惨了,临时用1.7.0的Dashboard代码覆盖1.7.2的暂时没问题了
期待最新稳定版修复bug,感谢!

@hhyo
Copy link
Owner

hhyo commented Nov 29, 2019

这个其实发现一段时间,只是感觉权限控制的挺严就没着急修,看来还是有影响,现在已经修复,周末更新一版,方便的话可使用hhyo/ archery:master 的镜像协助验证一下,已自动build

xxlaila pushed a commit to xxlaila/Archery that referenced this issue Feb 15, 2025
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants