User with no ui.filter.modifyGlobalConfiguration can delete global filter configuration

Support
#1

Hello,
We noticed that user with no ui.filter.modifyGlobalConfiguration can delete global filter configuration.

We used the following steps to reproduce the issue:

  1. Create global configuration with user that has assigned ui.filter.modifyGlobalConfiguration
  2. Open the filter configuration with user that has only ui.filter.modifyConfiguration granted
  3. Verified that user is:
  • able to see the configuration as expected
  • not able to edit the configuration as expected
  • is capable of deleting the global configuration, without being granted with ui.filter.modifyGlobalConfiguration as per Filter :: Jmix Documentation

I’m adding a demo project which can be used for reproducing the issue.

Kind regards,
Dimitar Stoyanov
FilterConfiguration.zip (263.4 KB)

#3

Hi,

Are you talking about this issue? If so, then it has been fixed in 1.5.0

#4

Hello, Maxim,
thank you for your reply!
Yes it looks like the same problem. Once we update the version will check it again.

Kind regards,
Dimitar