admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4718 - report and translation import need create rights

Browse Source 
report/upload and translation/upload had no role check, so any login, customer
contacts included, could import a report template (whose JavaScript runs in the
server's browser at render time) or a translation (security review F19, F24).
Both now require the same right as creating one, checked before the upload is
read. The import screens are already limited to those roles.

Checked locally: customer contact and Service 403, BizAdmin 202.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 12:10:00 -07:00
parent a843bd3132
commit 705a54f9d8
4 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
devdocs/modernization/NET10-PORT.md
View File

@@ -184,7 +184,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4715 | Download file names checked (one helper) | F21 |
| 4716 | Pick-list search text as SQL parameters | F18 |
| 4717 | KPI interval allowlist | F26 |
| 4718 | Report and translation import need create rights | F19, F24 |
| 4718 | Report and translation import need create rights | F19, F24. **Done** (contact and Service 403, BizAdmin 202; test `ImportRights`) |
| 4719 | Report page network restricted; notification reports not run as SuperUser | F20 |
| 4720 | Restricted roles filtered in report/export data | F27 |
| 4721 | Client escaping of record text | F33 |