<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Carlos,<br>
<br>
I'm with Jo on this one. We are on 3.6.4 and I have over 100 users
and the majority of them do <i><b>NOT</b></i> have the "ShowConfigTab"
right yet they <i><b>ALL</b></i> can modify their "RT at a Glance"
settings.<br>
<br>
<br>
Kenn<br>
LBNL<br>
<br>
On 6/5/2009 3:13 AM, Jo Rhett wrote:
<blockquote
cite="mid:84DB29AC-801C-43A5-AF5A-8115180638A3@netconsonance.com"
type="cite">Are you sure it's the global RT At a Glance? It seems
everyone can modify it for themselves...
<br>
<br>
On Jun 5, 2009, at 12:55 AM, Carlos Garcia Montoro wrote:
<br>
<blockquote type="cite">Hi Kenn, hi everybody,
<br>
<br>
Thank you for your answer. I was expecting the same behaviour as you.
But for my unpleasant surprise, a user who only has
<br>
- "ShowConfigTab" global right for himself.
<br>
- "ShowAprovalsTab" global right for Privileged users. And
<br>
- "CreateTicket" and "SeeQueue" in some queues as Everyone's rights in
those queues.
<br>
can do nothing harmful with the single exception of modifying the
global RT at a glance.
<br>
<br>
This behaviour has surprised me probably as much as you. Because of it,
I want that someone else checks this configuration in order to see
whether it is my fault (I am doing something wrong) or it is a RT bug
(this happens to everybody, but it shouldn't).
<br>
<br>
Greetings,
<br>
Carlos
<br>
<br>
PS: I found somewhere a RT installation for testing purposes, but
users grants, including root, where so restricted, that I couldn't
reproduce the configuration I wanted.
<br>
<br>
Ken Crocker wrote:
<br>
<blockquote type="cite">Carlos,
<br>
I may be mistaken, butI think the "ShowConfigTab" merely allows the
user to see that tab and the functions under it. The user still needs
to have other rights (like "ShowTemplate" and "ModifyTemplate") in
order to see/modify templates and I'm sure the same situation exists
for other objects to be modified.
<br>
Kenn
<br>
LBNL
<br>
On 6/4/2009 2:54 AM, Carlos Garcia Montoro wrote:
<br>
<blockquote type="cite">Sorry for posting this twice, but I'm
trying to make it shorter.
<br>
<br>
Please, can anyone confirm me that a user who only has the global right
"ShowConfigTab" is able to modify the global RT at a glance?
<br>
<br>
I'm using RT 3.8.2 and I would like to know if either I'm doing
something wrong or this is the expected behaviour. If this were the
second case, should this be considered a bug?
<br>
<br>
For a longer explanation, attached you can find my previous message.
<br>
<br>
Thanking you in advance,
<br>
Carlos
<br>
<br>
------------------------------------------------------------------------
<br>
<br>
Subject:
<br>
[rt-users] Rights issue on Configuration -> Global -> RT at a
glance on RT 3.8.2
<br>
From:
<br>
Carlos Garcia Montoro <a class="moz-txt-link-rfc2396E" href="mailto:cgarcia@ific.uv.es"><cgarcia@ific.uv.es></a>
<br>
Date:
<br>
Fri, 29 May 2009 12:18:06 +0200
<br>
To:
<br>
<a class="moz-txt-link-abbreviated" href="mailto:rt-users@lists.bestpractical.com">rt-users@lists.bestpractical.com</a>
<br>
<br>
To:
<br>
<a class="moz-txt-link-abbreviated" href="mailto:rt-users@lists.bestpractical.com">rt-users@lists.bestpractical.com</a>
<br>
<br>
<br>
Hello,
<br>
<br>
I've a question/request about RT that I have been neither able to
resolve from myself, nor have I found it at the RT wiki or googling
this mailing list.
<br>
<br>
I'm newbie using RT. I'm installing an organizational RT (ver. 3.8.2).
We have some departments that are autonomous of each other. Thus, I
want to grant some privileges for every admin group of each department.
I want to allow them to handle their own queues, groups, etc. But I
also want not to allow them to modify others space. I have achieved
this configuration, i.e. admins are only able to see their groups,
admins can see all queues but they are only allowed to modify some
properties (Cc, AdminCc,...) of their own queues but not other queues.
In order to do that I have granted them the global right
"ShowConfigTab". Otherwise they had rights but they couldn't use them
(they couldn't modify group membership of their groups,...).
<br>
<br>
The problem I'm suffering is this: When I grant the "ShowConfigTab"
right to a user or group, I'm also granting privileges to modify the
global RT at a glance. Let me show an example: Let me create a user foo
who can be granted rights ("Let this user be granted rights" is
checked). This new user isn't a member of any group, so he has no right
rather than "Everyone" and "Privileged". At this moment, global rights
for these groups are the default (no global right for "Everyone", and
only "ShowApprovalsTab" for "Privileged"). In some queues "Everyone"
has two rights "CreateTicket" and "SeeQueue", but as far as I know they
only grant privileges for creating a new ticket in these queues. Let
this user be granted the global "ShowConfigTab" right ( "Configuration"
-> "Global" -> "User Rights", and there foo is granted to
"ShowConfigTab"). Now let foo log in. This user can see the
configuration tab, but he can't modify anything since he is not allowed
to. If he tries to modify anything RT won't allow it and foo will read
a permission denied message. But if foo goes to "Configuration" ->
"Global" -> "RT at a glance" and there he deletes "QuickCreate", RT
allows it saying "Global portlet body saved.". Now let the privileged
user bar log in. The RT at a glance of bar has no longer the
"QuickCreate" frame when it previously had it. Hence, I don't want to
grant foo the right of modifying the global RT at a glance!
<br>
<br>
Is it the expected behaviour? Am I missing anything or doing something
wrong?
<br>
<br>
Thank you,
<br>
Carlos
<br>
<br>
_______________________________________________
<br>
<a class="moz-txt-link-freetext" href="http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users">http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users</a>
<br>
<br>
Community help: <a class="moz-txt-link-freetext" href="http://wiki.bestpractical.com">http://wiki.bestpractical.com</a>
<br>
Commercial support: <a class="moz-txt-link-abbreviated" href="mailto:sales@bestpractical.com">sales@bestpractical.com</a>
<br>
<br>
<br>
Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
Buy a copy at <a class="moz-txt-link-freetext" href="http://rtbook.bestpractical.com">http://rtbook.bestpractical.com</a>
<br>
_______________________________________________
<br>
<a class="moz-txt-link-freetext" href="http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users">http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users</a>
<br>
<br>
Community help: <a class="moz-txt-link-freetext" href="http://wiki.bestpractical.com">http://wiki.bestpractical.com</a>
<br>
Commercial support: <a class="moz-txt-link-abbreviated" href="mailto:sales@bestpractical.com">sales@bestpractical.com</a>
<br>
<br>
<br>
Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
Buy a copy at <a class="moz-txt-link-freetext" href="http://rtbook.bestpractical.com">http://rtbook.bestpractical.com</a>
<br>
<br>
</blockquote>
</blockquote>
<br>
-- <br>
_______ _______________________________________________________________
<br>
| __ __ | Carlos García Montoro Ingeniero
Informático
<br>
|_\_Y_/_| Instituto de Física Corpuscular Centro Mixto CSIC -
UV
<br>
|\_] [_/| Servicios Informáticos
<br>
| [_] | Edificio Institutos de Investigación
<a class="moz-txt-link-abbreviated" href="mailto:cgarcia@ific.uv.es">cgarcia@ific.uv.es</a>
<br>
|C S I C| Apartado de Correos 22085 E-46071 Valencia Tel: +34
963543706
<br>
|_______| España / Spain Fax: +34
963543488
<br>
<cgarcia.vcf>_______________________________________________
<br>
<a class="moz-txt-link-freetext" href="http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users">http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users</a>
<br>
<br>
Community help: <a class="moz-txt-link-freetext" href="http://wiki.bestpractical.com">http://wiki.bestpractical.com</a>
<br>
Commercial support: <a class="moz-txt-link-abbreviated" href="mailto:sales@bestpractical.com">sales@bestpractical.com</a>
<br>
<br>
<br>
Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
<br>
Buy a copy at <a class="moz-txt-link-freetext" href="http://rtbook.bestpractical.com">http://rtbook.bestpractical.com</a>
<br>
</blockquote>
<br>
</blockquote>
</body>
</html>