-
Notifications
You must be signed in to change notification settings - Fork 71
Description
In an e-mail chain it came to light that an agency specific admin could view all of the Website Backends on the listing page within the admin. This should not be the case, since only super user admins should be able to view all backends.
It does not appear like the agency specific admin can actually edit the website backends (the forms are blank), so our show/update/create permissions might be correct, but we should sanity check all these permissions.
A curious part to this is that as an NREL-only admin user, I was not able to view the other agency website backends. Instead, I was only able to see the single NREL backend I should have. But as a DOC-only admin, I was able to view the listing of all of them. So maybe this bug on the listing page only crops up when you don't have any website backends at all.