pgadmin4
pgadmin4 copied to clipboard
Users without Manage Server permission can still add servers in Query Tool
Describe the bug
As far as I understand the point of "Manage Server" permission is to lock down users that they could only access predefined list of servers. Unfortunately, they can still use Query Tool Workspace and connect to any known server on the environment.
To Reproduce
Steps to reproduce the behavior:
- Login with pgAdmin Administrator, go to
User Management->Permissionsand disableManage Serverpermissions fromUserrole. - Now login with pgAdmin User and go to Query Tool Workspace -> Welcome page.
- Here you can still use a form to specify any PostgreSQL server you want.
Expected behavior
Users without Manage Server permission should not be able to login to other servers in the system. Alternatively, new permission could be implemented to control just user provided servers. It could be called Connect to all servers or something like that. When disabled it would allow to connect only to servers in the Object Explorer.
@ViliusS This is primarily for the saving the server info on the tree and that's why it is called Manage server. The one you enter and connect from QT workspace are not saved anywhere, but this can be improved.