[ProGet] Bug/Issue: Fails to display feed page when account does not have access to any feeds.

Nils Nilsson

Hello!

I'm seeing an issue where an account which has permissions for a specific 'Feed & Project Group', when the group does not contain any feeds, is not able to view the feeds page, even though it has permission to create feeds within the group.

These are the permissions that the account has, scoped to a Group which has a few projects, but no feeds yet.

The issue resolves itself if I provide the account access to a feed.
As an example here I've assigned Authenticated access to a feed, to show that the /feeds page starts working as intended again.

It also resolves if I use some other means of giving access to a feed, such as using another account to create a feed in the feed group.

Other pages like /packages and /assets also do not work until the account has access to some feed(asset directory included)

Instead of a generic 403 error it should specify that there is nothing to see, unless you have the permission to create something, in which case encourage that instead.

Best regards
Nils Nilsson

stevedennis

Hi @Nils-Nilsson ,

This is a known issue/shortcut that we take in ProGet: 403 if the user cannot perform task X in at least one feed. We use it in a LOT of places; you identified some of them.

The reason we do this is that it reduces the amount of code required to validate permissions.

However, I'm not sure if there is any practical impact; we can't imagine a realistic scenario where a user would need to access ProGet but not be able to access any feeds.

Let us know if that assumptiton is incorrect...

Thanks,
Steve

Nils Nilsson

@stevedennis

Hi!

If it's a conscious choice then I understand.

The scenario that conjured this is that we onboard a new user group for some project with their own Feed & Project Group, and they can not create the first feed(in case they didn't specify any when first requesting onboarding), instead requiring Admin intervention.
It should be rare enough that it's acceptable.

Another scenario is that you have a team that only interacts with ProGet to assess vulnerabilities, where they only use the Reporting & SCA section, however in this scenario it doesn't really matter if they get errors navigating to Feeds/Package/Assets.

Thanks for your time

Nils Nilsson