Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ACL): Add check to prevent users from revoking their own access #2960

Merged
merged 1 commit into from
Feb 7, 2025

Conversation

icewind1991
Copy link
Member

@icewind1991 icewind1991 commented May 14, 2024

When changing ACL rules, check if the new rule set would lead the current user without read permissions

  • make the UI properly handle the error
  • (maybe) add an option to force revoking the access anyway

@icewind1991 icewind1991 added the 2. developing Items that are currently under development label May 14, 2024
Copy link
Member

@jancborchardt jancborchardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@icewind1991 since you said

Would it maybe make more sense to just fully prevent users from revoking their own access?

I would say the modal is better, because maybe you do want to get out of the group folder?

Access removal
Proceeding will remove your own access to this group folder.
[ Cancel ] [ Remove own access ]

@provokateurin
Copy link
Member

Fixes #2822

@provokateurin
Copy link
Member

I would say the modal is better, because maybe you do want to get out of the group folder?

I don't think this makes sense, since in fact you do not remove yourself from the Team folder this way.
If the user no longer wants access, then an admin has to remove their access and they can not do it themselves through ACL (which also only works on sub folders, not the root Team folder itself anyway).

@provokateurin provokateurin added enhancement 3. to review Items that need to be reviewed and removed 2. developing Items that are currently under development labels Feb 3, 2025
@provokateurin provokateurin marked this pull request as ready for review February 3, 2025 12:13
Signed-off-by: Robin Appelman <robin@icewind.nl>
Signed-off-by: provokateurin <kate@provokateurin.de>
@provokateurin provokateurin changed the title add check to prevent users from revoking their own access fix(ACL): Add check to prevent users from revoking their own access Feb 3, 2025
@provokateurin provokateurin merged commit af63689 into master Feb 7, 2025
50 checks passed
@provokateurin provokateurin deleted the prevent-revoke-self branch February 7, 2025 08:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Items that need to be reviewed enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants