Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ResponseOps][Alerts] Mute alert option visible to user with only read permission #191060

Closed
js-jankisalvi opened this issue Aug 22, 2024 · 1 comment · Fixed by #191283
Closed

[ResponseOps][Alerts] Mute alert option visible to user with only read permission #191060

js-jankisalvi opened this issue Aug 22, 2024 · 1 comment · Fixed by #191283
Assignees
@guskovaue
Labels
bug Fixes for quality problems that affect the customer experience Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@js-jankisalvi
Copy link
Contributor

js-jankisalvi commented Aug 22, 2024 •
edited
Loading

Kibana version: 8.15

Browser version: Chrome

Describe the bug:
User with Read privilege to Management > Stack Rules, Rules Settings, Actions and Connectors is able to see option to mute an alert.

While clicking on the link, user gets an unauthorized error.
User also sees an option to Mark as untracked for an alert. Which also throws 403 error on click.

Steps to reproduce:

  1. Create a Stack alerts rule that generates some alerts
  2. Create a user with Management > Stack Rules, Rules Settings, Actions and Connectors to Read.
  3. Login with this user
  4. Go to alerts page, click on any active alert
  5. User sees option to mute, click on it
  6. User gets an unauthorized error
  7. Click on mark as untracked, it also throws an unauthorized error

Expected behavior:
User with read privilege should not be able to see Mute and Mark as untracked option

Screenshots (if relevant):
Screenshot 2024-08-22 at 10 32 47
Screenshot 2024-08-22 at 10 33 27
@js-jankisalvi js-jankisalvi added bug Fixes for quality problems that affect the customer experience Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Aug 22, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@guskovaue guskovaue self-assigned this Aug 26, 2024
@guskovaue guskovaue mentioned this issue Aug 26, 2024
Merged
1 task
@guskovaue guskovaue linked a pull request Aug 29, 2024 that will close this issue
[MX] Mute alert options with read only permission #191283
Merged
1 task
guskovaue added a commit that referenced this issue Aug 29, 2024
@guskovaue
[MX] Mute alert options with read only permission (#191283)
2d81ab6 
Issue: #191060

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Aug 29, 2024
@guskovaue
[MX] Mute alert options with read only permission (elastic#191283)
00257f8 
Issue: elastic#191060

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios.

(cherry picked from commit 2d81ab6)
kibanamachine referenced this issue Sep 2, 2024
@kibanamachine @guskovaue @elasticmachine
[8.15] [MX] Mute alert options with read only permission (#191283) (#…
44f30cc 
…191740)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[MX] Mute alert options with read only permission
(#191283)](#191283)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT
[{"author":{"name":"Julia","email":"iuliia.guskova@elastic.co"},"sourceCommit":{"committedDate":"2024-08-29T14:35:52Z","message":"[MX]
Mute alert options with read only permission (#191283)\n\nIssue:
https://github.com/elastic/kibana/issues/191060\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios.","sha":"2d81ab694e079c4cc1d9ebc3b8586f4bfe7bb20a","branchLabelMapping":{"^v8.16.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:ResponseOps","ci:project-deploy-observability","Team:obs-ux-management","v8.15.0","v8.16.0"],"title":"[MX]
Mute alert options with read only
permission","number":191283,"url":"https://github.com/elastic/kibana/pull/191283","mergeCommit":{"message":"[MX]
Mute alert options with read only permission (#191283)\n\nIssue:
https://github.com/elastic/kibana/issues/191060\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios.","sha":"2d81ab694e079c4cc1d9ebc3b8586f4bfe7bb20a"}},"sourceBranch":"main","suggestedTargetBranches":["8.15"],"targetPullRequestStates":[{"branch":"8.15","label":"v8.15.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/191283","number":191283,"mergeCommit":{"message":"[MX]
Mute alert options with read only permission (#191283)\n\nIssue:
https://github.com/elastic/kibana/issues/191060\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios.","sha":"2d81ab694e079c4cc1d9ebc3b8586f4bfe7bb20a"}}]}]
BACKPORT-->

Co-authored-by: Julia <iuliia.guskova@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@guskovaue guskovaue

Labels
bug Fixes for quality problems that affect the customer experience Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[MX] Mute alert options with read only permission guskovaue/kibana
3 participants
@elasticmachine @guskovaue @js-jankisalvi