Users performing a subject search can see groups for which they do not have vioew access

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Minor
    • 1.5.0
    • Affects Version/s: 1.4.2
    • Component/s: API
    • None

      GrouperSourceAdapter always uses a 'root' session when searching so any matching group is returned regardless of whether the logged in user has VIEW privilege. The fix will call GrouperSession.staticGrouperSession to see if there is a current session (held in a ThreadLocal) and use that if available.

            Assignee:
            Gary Brown (Inactive)
            Reporter:
            Gary Brown (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: