ability to view details of other users

John Mazzitelli jmazzite at redhat.com
Fri Feb 17 21:37:43 UTC 2012


I would leave phone and email open. Because if you see something bad
happening on a resource that a user modified or owns or what have you,
you will want to get in touch with them. Being able to find the
email/phone would be helpful.

Hiding phone/email from everyone except for MANAGE_SECURITY users seems
less useful.

On Fri, 2012-02-17 at 16:33 -0500, Ian Springer wrote:
> I'm working on https://bugzilla.redhat.com/show_bug.cgi?id=786159.
> 
> Currently, a regular user can view the following details about any other 
> user (via #Administration/Security/Users):
> 
> username
> first name
> last name
> department
> email
> phone
> login enabled?
> ldap user?
> 
> The assigned roles of other users cannot be viewed.
> 
> I propose we change it so they can only view the following fields:
> 
> username
> first name
> last name
> department
> 
> I think it makes sense to keep these basic details public, because it's 
> useful to know the real name and department for other users in the 
> system. For example, if I see that user pilhun deleted my WAR a few days 
> earlier, it would be nice if I could find out that pilhun is Heiko Rupp 
> from the JON dev team (facts not obvious from the username), without 
> having to go find an RHQ Admin and ask them. I can see hiding people's 
> phone number and email address for privacy purposes. I'm up in the air 
> about the two boolean fields.
> 
> Users with MANAGE_SECURITY would of course be able to view and edit all 
> details for all users, as they can today.
> 
> Please let me know if you have an opinion on this, as I'd like to come 
> up with a plan so I can implement it next week.
> 
> Thanks,
> Ian
> 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/rhq-devel




More information about the rhq-devel mailing list