SORMAS-Project
SORMAS-Project copied to clipboard
Consider right EVENT_VIEW (View existing events) in the case directory
Bug Description
A user without the right EVENT_VIEW (View existing events) can see data about the event in the case directory.
Steps to Reproduce
- Log in as Admin and find a user whit hasn't the rights "View existing events" / EVENT_VIEW
- Login with this user e.g. beke1 / B-Rolle
- Open the case directory in the detailed view
Expected Behavior
- [ ] Hide the columns related to events.
- [ ] The data should not be put into the CaseDataIndexDto as-well when the user right is not present
Screenshots
User roll in the admin view
System Details
- Device: Laptop
- SORMAS version: 1.75.0
- Android version/Browser: Chrome
- Server URL: test1401
- User Role: Admin / beke1
Additional Information
Solution as discussed with @MartinWahnschaffe: UI: Hide columns if EVENT_VIEW is not given Backend: hide there, too and leave empty
Verified ticket on local environment using the latest version of Sormas 1.76.0-SNAPSHOT from the development branch.