{"action":"opened","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/5325","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/5325/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/5325/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/5325/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/5325","id":385687943,"node_id":"MDU6SXNzdWUzODU2ODc5NDM=","number":5325,"title":"User with admin permissions cannot get another user","user":{"login":"edmundoa","id":716185,"node_id":"MDQ6VXNlcjcxNjE4NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/716185?v=4","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false},"labels":[{"id":445379285,"node_id":"MDU6TGFiZWw0NDUzNzkyODU=","url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/blocker","name":"blocker","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":{"login":"edmundoa","id":716185,"node_id":"MDQ6VXNlcjcxNjE4NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/716185?v=4","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false},"assignees":[{"login":"edmundoa","id":716185,"node_id":"MDQ6VXNlcjcxNjE4NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/716185?v=4","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/milestones/78","html_url":"https://github.com/Graylog2/graylog2-server/milestone/78","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/milestones/78/labels","id":3519924,"node_id":"MDk6TWlsZXN0b25lMzUxOTkyNA==","number":78,"title":"2.5.0","description":null,"creator":{"login":"bernd","id":461,"node_id":"MDQ6VXNlcjQ2MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/461?v=4","gravatar_id":"","url":"https://api.github.com/users/bernd","html_url":"https://github.com/bernd","followers_url":"https://api.github.com/users/bernd/followers","following_url":"https://api.github.com/users/bernd/following{/other_user}","gists_url":"https://api.github.com/users/bernd/gists{/gist_id}","starred_url":"https://api.github.com/users/bernd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernd/subscriptions","organizations_url":"https://api.github.com/users/bernd/orgs","repos_url":"https://api.github.com/users/bernd/repos","events_url":"https://api.github.com/users/bernd/events{/privacy}","received_events_url":"https://api.github.com/users/bernd/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":26,"state":"open","created_at":"2018-07-24T14:58:06Z","updated_at":"2018-11-29T11:21:04Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2018-11-29T11:21:04Z","updated_at":"2018-11-29T11:21:04Z","closed_at":null,"author_association":"MEMBER","body":"On the current master and 2.5, a user with admin permissions cannot get information for another user as the server returns a 403:\r\n\r\n```\r\n$ http --auth hans :9000/api/users/poppy\r\nHTTP/1.1 403 Forbidden\r\n{\r\n    \"message\": \"Not allowed to view user poppy\",\r\n    \"type\": \"ApiError\"\r\n}\r\n\r\n$ http --auth hans :9000/api/users/hans | jq .permissions\r\n[\r\n  \"dashboards:read:5b2a58c4621724d5bff74faa\",\r\n  \"dashboards:read:5b437f429afa72394e13c637\",\r\n  \"users:edit:hans\",\r\n  \"dashboards:edit:5b2a58c4621724d5bff74faa\",\r\n  \"dashboards:edit:5b437f429afa72394e13c637\",\r\n  \"users:tokenremove:hans\",\r\n  \"users:tokenlist:hans\",\r\n  \"users:tokencreate:hans\",\r\n  \"users:passwordchange:hans\",\r\n  \"*\"\r\n]\r\n```\r\n\r\nThe same request works fine if it is done by the system admin user. The issue was introduced in https://github.com/Graylog2/graylog2-server/pull/5079.\r\n\r\n## Expected Behavior\r\nAll users with admin permissions are able to get information about any user in the system.\r\n\r\n## Current Behavior\r\nOnly the system admin is able to do that at the moment.\r\n\r\n## Steps to Reproduce (for bugs)\r\n1. Create an admin account\r\n2. Log in with the new account\r\n3. Go to the System -> Authentication page, and try to edit another user\r\n4. See a 404 page, check that the network request to the user resource failed with a 403\r\n\r\n## Your Environment\r\n* Graylog Version: Graylog 2.5.0-beta.2-SNAPSHOT and Graylog 3.0.0-alpha.5-SNAPSHOT \r\n\r\n"}}
{"actor":{"display_login":"edmundoa"}}