starred/panel-pelican-dev
1
0
Fork 0
mirror of https://github.com/pelican-dev/panel.git synced 2026-07-16 04:03:50 +03:00
Code Issues 41 Packages Projects Releases 10 Wiki Activity

Missing permission checks on create server page #346

New Issue
Closed
opened 2026-02-05 17:28:37 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 17:28:37 +03:00
Owner
Copy Link

Originally created by @parataku on GitHub (May 24, 2025).

Originally assigned to: @Boy132 on GitHub.

Current Behavior

The create server page does not respect some of the permissions defined on the roles.

  • User can VIEW all users in the owner combo-box without having the User List View / View permission.
  • User can CREATE a new user via the + button next to the combo-box without having the User Create permission.

Expected Behavior

The create server page should respect the permissions assigned to the user.

Steps to Reproduce

1.) Create a role that has none of the User permissions
2.) Assign this role to a user
3.) Open create server page with this user

Panel Version

v1.0.0-beta21

Wings Version

1.0.0-beta13

Games and/or Eggs Affected

No response

Docker Image

No response

Error Logs

Is there an existing issue for this?

  • I have searched the existing issues before opening this issue.
  • I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server.
  • I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
Originally created by @parataku on GitHub (May 24, 2025). Originally assigned to: @Boy132 on GitHub. ### Current Behavior The create server page does not respect some of the permissions defined on the roles. - User can VIEW all users in the owner combo-box without having the User List View / View permission. - User can CREATE a new user via the + button next to the combo-box without having the User Create permission. ### Expected Behavior The create server page should respect the permissions assigned to the user. ### Steps to Reproduce 1.) Create a role that has none of the User permissions 2.) Assign this role to a user 3.) Open create server page with this user ### Panel Version v1.0.0-beta21 ### Wings Version 1.0.0-beta13 ### Games and/or Eggs Affected _No response_ ### Docker Image _No response_ ### Error Logs ```bash ``` ### Is there an existing issue for this? - [x] I have searched the existing issues before opening this issue. - [x] I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server. - [x] I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
not confirmed
pull-request
Mirrored from GitHub Pull Request
 👑 sponsor
💰 fund
🔴 hard
🟡 medium
🟡 medium
🟡 medium
🟢 easy
🟢 easy
🟢 easy
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/panel-pelican-dev#346
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?