[ZEPPELIN-3096] a non owner of a note can change notes permissions

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.7.3
• Component/s: security

Environment

linux ubuntu 17.10

• Assignee: Unassigned
• Reporter: gilbert marx
• Created: 07/Dec/17 17:45
• Updated: 26/Jul/18 13:26

Description

when i am on a note as a user that is only Reader , i can change the permissions on this note and it is succsessfully done.

example:
admin is owner and writer on this note and jdcuser is reader (screenshot-1). I am logged as jdcuser (screenshot-1)

then i can add jdcuser as writer (or owner it works screenshot-2)

and then save this; it is done successfuly (screenshot-3).

the other permissions are ok; jdcuser can't access to interpretter or to change the mode of the note.

Issue Links

• is duplicated by: ZEPPELIN-2980 Issues found through editing Note Permission