Hide vulnerability dismiss buttons for users with developer role
What does this MR do and why?
On the pipeline security tab, a vulnerability table is shown:
We recently changed the Developer
role so that it can no longer admin vulnerabilities, where "admin vulnerabilities" means the ability to change the vulnerability status, most notably dismissing and undismissing it. This MR changes it so that the dismiss/undismiss actions are hidden when the user has permissions to see the report, but not admin it. It make the following changes:
- The table header no longer shows the "select all" checkbox, and each row no longer shows the bulk select checkbox:
Before | After |
---|---|
- The finding modal no longer shows the
Dismiss
/Undo dismiss
buttons:
Before | After |
---|---|
How to set up and validate locally
- Enable the feature flag
disable_developer_access_to_admin_vulnerability
. - Clone this project: https://gitlab.com/gitlab-examples/security/security-reports
- Run a pipeline against the master branch.
- Add a user to the project and assign them the
Developer
role. - Impersonate or log in as the user and go to the pipeline details page. Click on the security tab.
- Verify that the table and finding modal does not show the dismiss actions.
- Log back in as the admin user. Change the user's role to
Maintainer
orOwner
. - Log back in as the user and verify that the table and finding modal show the dismiss actions.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #432487 (closed)
Edited by Daniel Tian