You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
When creating a task (like request description) you can assign either user or a team/group/business unit to approve/decline it. The bug allows for a user to assign a team they are a part of to a task and subsequently self-approve it. It allows to bypass 4 eyes principle I think should be enforced in every scenario for task workflow.
To Reproduce
add user X to team Y
create a task 'request description' to a table and add Y team as approvers for this task
user X can now self-approve the request
Expected behavior
users can't self-approve if the request was assigned to users team. this enforces 4 eyes principle in every scenario.
Affected module
UI
Describe the bug
When creating a task (like request description) you can assign either user or a team/group/business unit to approve/decline it. The bug allows for a user to assign a team they are a part of to a task and subsequently self-approve it. It allows to bypass 4 eyes principle I think should be enforced in every scenario for task workflow.
To Reproduce
Expected behavior
Version:
openmetadata-ingestion[docker]==XYZ
]Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: