senaite.core icon indicating copy to clipboard operation
senaite.core copied to clipboard

Insufficient privileges error page is too informative

Open xispa opened this issue 4 years ago • 0 comments

When user tries to access to an object for which does not have enough privileges granted, the system displays the "Insufficient privileges" error view. System should display a less informative message (e.g like the one that appears when a page is not found), while keeping the trace in the error log.

Ideally, the message should always be the same, so the user will never know if the object does not really exist, or he/she does not have enough privileges. This rule must apply, regardless of the roles/groups the user belongs to. When dealing with sensitive data, system should be always neutral and not provide any hint to the end-user. Same applies for the json API.

xispa avatar Apr 29 '20 21:04 xispa