Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API for non admin user lets them check-out/in as any other user, including admin #40

Open
vzickus opened this issue Oct 1, 2023 · 1 comment
Open

API for non admin user lets them check-out/in as any other user, including admin #40

vzickus opened this issue Oct 1, 2023 · 1 comment
Labels
question Further information is requested

Comments

@vzickus
Copy link

vzickus commented Oct 1, 2023

Describe the bug
Creating an API key from a non-admin user, still allows the non-admin user to check out/in as any other user.

To Reproduce
Create a user with limited access rights on the server, but allow them to create API keys. Link the API key to the app without modifying PHP (as it only makes sense that an admin would do that).

Expected behavior
API key should only allow the user to check-out/in using their own username.

Smartphone (please complete the following information):

  • Device: NOKIA XR20
  • OS: Android 13

Additional context
Alternative suggestions: have a login for user.
@diegogarciadev
Copy link
Owner

I'm not sure if I understand your message. Thanks.

@diegogarciadev diegogarciadev added the question Further information is requested label Aug 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@diegogarciadev @vzickus