Prevent update of role for normal user #31

New Issue

Open

opened 2021-06-09 10:39:24 +02:00 by christoph.lienhard · 0 comments

christoph.lienhard commented

2021-06-09 10:39:24 +02:00

(Migrated from git.verdigado.com)

Currently, each person can update their own row in the person table. This includes their own role which enables privilege escalation.

Prevent that.

Thing to consider:

in principle, roles must be visible to some extend to everyone (at least filtering for candidates and editors has to be possible for everyone)
editors still can change roles of users
Views might be a solution, consider https://www.2ndquadrant.com/en/blog/how-do-postgresql-security_barrier-views-work/ and https://www.graphile.org/postgraphile/views/

Currently, each person can update their own row in the person table. This includes their own role which enables privilege escalation. Prevent that. Thing to consider: * in principle, roles must be visible to some extend to everyone (at least filtering for candidates and editors has to be possible for everyone) * editors still can change roles of users * Views might be a solution, consider https://www.2ndquadrant.com/en/blog/how-do-postgresql-security_barrier-views-work/ and https://www.graphile.org/postgraphile/views/

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: NB-Public/kandimat#31

No description provided.