Skip to content

Limited agency admins can view all website backends #261

@GUI

Description

@GUI

In an e-mail chain it came to light that an agency specific admin could view all of the Website Backends on the listing page within the admin. This should not be the case, since only super user admins should be able to view all backends.

It does not appear like the agency specific admin can actually edit the website backends (the forms are blank), so our show/update/create permissions might be correct, but we should sanity check all these permissions.

A curious part to this is that as an NREL-only admin user, I was not able to view the other agency website backends. Instead, I was only able to see the single NREL backend I should have. But as a DOC-only admin, I was able to view the listing of all of them. So maybe this bug on the listing page only crops up when you don't have any website backends at all.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions