ability to view details of other users

Ian Springer ian.springer at redhat.com
Fri Feb 17 21:33:14 UTC 2012


I'm working on https://bugzilla.redhat.com/show_bug.cgi?id=786159.

Currently, a regular user can view the following details about any other 
user (via #Administration/Security/Users):

username
first name
last name
department
email
phone
login enabled?
ldap user?

The assigned roles of other users cannot be viewed.

I propose we change it so they can only view the following fields:

username
first name
last name
department

I think it makes sense to keep these basic details public, because it's 
useful to know the real name and department for other users in the 
system. For example, if I see that user pilhun deleted my WAR a few days 
earlier, it would be nice if I could find out that pilhun is Heiko Rupp 
from the JON dev team (facts not obvious from the username), without 
having to go find an RHQ Admin and ask them. I can see hiding people's 
phone number and email address for privacy purposes. I'm up in the air 
about the two boolean fields.

Users with MANAGE_SECURITY would of course be able to view and edit all 
details for all users, as they can today.

Please let me know if you have an opinion on this, as I'd like to come 
up with a plan so I can implement it next week.

Thanks,
Ian



More information about the rhq-devel mailing list