topic Re: MUI - Problem: permission "Share Reports" broken in Fusion Manage Forum

MUI - Problem: permission "Share Reports" broken

PLM-Sylvain.Bailly — Tue, 10 Mar 2020 15:31:17 GMT

Hello,

The permission "Share Reports" gives the ability to share reports with users, groups, or everyone: Autodesk blog

If I give this permission through a role, associated to a group, then linked to a user, the user can create a report and share it with people. But NORMALLY, if I remove this permission, the user must not have the possibility to share the report..... I have done some tests and I think that there is a problem.

Even if the user doesn't have the permission, he can share the report which can be a security issue (for example, a supplier can see the other supplier groups or employees of their competitors).

The problem appears in the Classic User Interface and with the Modern User Interface.

@giliar.defriesperez Thx for your help,

Sylvain

Re: MUI - Problem: permission "Share Reports" broken

philipfrench — Tue, 10 Mar 2020 18:48:11 GMT

I half-agree...

In the workspace below, I have no right to share a report on this workspace, because I do not have Share Report permission.

The bug is that the user can see the report that I shared (or for this report, on this workspace, it should not give me the Share/Public option in the report creation page)

However...

The share-to user cannot see the report (it does not appear in his Reports page), until I give the user "View Items" permission on that workspace.

The items that he can see in the report, are still subject to additional/-owner visibility.

When he does not have view permission on this workspace, he cannot see the report, nor the items.

So granting him access to a shared report, is NOT giving him any more access than he could get through going to the workspace menu, viewing items, and perhaps creating a report himself.

I agree though if I create 2 reports, called "Items Created by Supplier 1", and "Items Created by Supplier2".. then if Supplier2 runs the first report, it should return perhaps zero rows.

But he could see the names of both reports, and realise you have another Supplier. You might not want to share that particular info.

But I could not reproduce an item-access security breach in my testing. Perhaps I am misunderstanding you.

Re: MUI - Problem: permission "Share Reports" broken

PLM-Sylvain.Bailly — Tue, 10 Mar 2020 20:03:10 GMT

Hi,

The problem is not in the result of the report but the creation of the report itself. If a supplier can create a report, he can see the different groups and users of the PLM. If you work in a very specific business, competitors and business employees specialists are known. So, you can easily deduct that they have access to some information of the PLM.

Normally, if the permission "shared reports" is not given, I expect to not have access to the "share report" picklist (in red below) and even fewer to the information of the groups and users (in red too):

Re: MUI - Problem: permission "Share Reports" broken

philipfrench — Tue, 10 Mar 2020 20:56:00 GMT

OK, so in this case, I agree it looks like a bug to me.

Without this permission, you should not be able to access this drop down, and hence not see the groups/users dialog.

I never considered that this permission was, in effect, to protect visibility to Groups/Users. I don't know if that was the design intent, but I do very much understand your scenario.

Re: MUI - Problem: permission "Share Reports" broken

giliar.defriesperez — Wed, 11 Mar 2020 15:33:53 GMT

@PLM-Sylvain.Bailly ,

Thanks for bringing this to our attention.

To summarize:

User doesn't have "Share Reports" access to WorkspaceA
User has regular access to View Items (at least) on WorkspaceA
User is able to create a report on WorkspaceA
User is able to view the "Share Report" dropdown in the Report Creation screen

Did I get it right, and you are reporting an issue on bullet #4? I'm not seeing it on my end. Can you clarify if I'm missing something?

With "Share Reports" permission for "Search Test WS":

Without "Share Reports" permission for "Search Test WS":

Let me know.

Thanks,

Giliar

Re: MUI - Problem: permission "Share Reports" broken

PLM-Sylvain.Bailly — Wed, 11 Mar 2020 16:11:47 GMT

I have not the same result as you @giliar.defriesperez .

For me, if the user DOES NOT have the permission "Share Reports", he can still see the drop down picklist and if he selects "Shared Report", he can see the 2 tables (groups and users).

@philipfrench : Could you please check on your tenant to see if you obtain the same thing?

Re: MUI - Problem: permission "Share Reports" broken

giliar.defriesperez — Wed, 11 Mar 2020 18:55:42 GMT

@PLM-Sylvain.Bailly , @philipfrench ,

Another note: there's an out-of-the-box group called "Admin Group", and that usually includes the role "User Administrator". That's a special role, containing an OOB set of permissions that include "Share Reports". That permission applies to all workspaces - make sure the user doesn't have that.

Thanks,

Giliar

Re: MUI - Problem: permission "Share Reports" broken

giliar.defriesperez — Wed, 11 Mar 2020 19:44:46 GMT

@PLM-Sylvain.Bailly @philipfrench

Ok, I think I see the issue here now. The problem seems to be that the permission is not granular enough - as soon as the user belongs to one group that contains one (or more) roles that have the "Share Reports" permission, it's showing the dropdown for all workspaces in the Create Report screen. That's too coarse.

Sylvain, please file a support case for this, and send me the case number via private message.

Thanks for bringing this up.

Giliar

Re: MUI - Problem: permission "Share Reports" broken

philipfrench — Wed, 11 Mar 2020 20:11:55 GMT

I confirm Giliar's observation.

I could not reproduce the problem with one particular user. His behaviour was as expected.

Then, as soon as I added him into a new group, new role, with a single permission "Share Reports" (and not even View Items)... on a totally different workspace, then he was incorrectly able to access this drop-down, whenever he created a report on ANY workspace.

Yes, it's a bug.

So for now you need to ensure your un-trusted users do not have permission to share report on ANY workspace (which is likely?), you won't suffer from this bug?

Re: MUI - Problem: permission "Share Reports" broken

PLM-Sylvain.Bailly — Wed, 11 Mar 2020 21:54:18 GMT

Thank you very much both of you for your help.

The user had the permission in another workspace this is why we had this result. I didn't investigate in that direction. It didn't come to my mind that permission of another workspace can influence on the result (and more specifically when we need to select a workspace at the beginning of the report creation).

Luckily, it is correctly configured in our Production server. Suppliers do not have this "shared report" permission in all the workspaces.

I will create a support case tomorrow.

Thank you very much again for your help.