Skip to content

403 on function assign_user_group_to_project() #189

Open
@Coulicoula

Description

@Coulicoula

Hi Black Duck Team

When using the assign_user_group_to_project() function, a user [with Project Manager rights - i.e default role as project creator] cannot add groups with roles within its own project. The reason why is because, you are not using the same endpoint when project roles have to be assigned or not:

  1. If you do not provide roles to the function assign_user_group_to_project(), you use the projects endpoint (https://SERVER/api/projects/PROJECT_HASH/roles)

It will work in any case because project creator try to access is own project. OK.

  1. However, if you provide roles (a role list or whatever), you use the usergroups endpoint (https://SERVER/api/usergroups/USERGROUP_HASH/roles)

It will not work if the user don't have the global role to access the usergroups endpoint. NOK

If the user don't have enough privileges, he will not be able to access this group endpoint, and the function return a 403 error, due to insufficient privileges.

I'm attaching to this issue a PR.
My proposal is to use in both cases the projects endpoint as it seems more natural in that situation.
Also, I've modified a json parameter that seemed to be outdated.
Regards,
Nicolas

Metadata

Metadata

Assignees

No one assigned

    Labels

    HubInstanceIssues relating to blackduck.HubInstance

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions