ability to view details of other users

John Mazzitelli jmazzite at redhat.com
Fri Feb 17 21:48:31 UTC 2012


OK, that's weird (I just read that BZ :).

We specifically made the conscious decision to NOT hide these details
like name, phone, email and department because it IS helpful to be able
to find a user's contact info when that user is listed in some
resource's alert history or other audit trails.

But I guess one user balked at that.

On Fri, 2012-02-17 at 16:44 -0500, Ian Springer wrote:
> Yeah, ideally I would just leave everything public too, but the BZ is 
> saying we should hide everything, so I was trying to find some sort of 
> compromise. Perhaps it should be configurable via a server setting, e.g.:
> 
> [ ] yes [x] no  -  Hide User Details - hide details of users from 
> non-admin users
> 
> The setting could be false by default, which would keep things the same 
> as they've always been by default, but give admins who are hardcore 
> about privacy a way to hide the details.
> 
> On 02/17/2012 04:37 PM, John Mazzitelli wrote:
> > I would leave phone and email open. Because if you see something bad
> > happening on a resource that a user modified or owns or what have you,
> > you will want to get in touch with them. Being able to find the
> > email/phone would be helpful.
> >
> > Hiding phone/email from everyone except for MANAGE_SECURITY users seems
> > less useful.
> >
> > On Fri, 2012-02-17 at 16:33 -0500, Ian Springer wrote:
> >> I'm working on https://bugzilla.redhat.com/show_bug.cgi?id=786159.
> >>
> >> Currently, a regular user can view the following details about any other
> >> user (via #Administration/Security/Users):
> >>
> >> username
> >> first name
> >> last name
> >> department
> >> email
> >> phone
> >> login enabled?
> >> ldap user?
> >>
> >> The assigned roles of other users cannot be viewed.
> >>
> >> I propose we change it so they can only view the following fields:
> >>
> >> username
> >> first name
> >> last name
> >> department
> >>
> >> I think it makes sense to keep these basic details public, because it's
> >> useful to know the real name and department for other users in the
> >> system. For example, if I see that user pilhun deleted my WAR a few days
> >> earlier, it would be nice if I could find out that pilhun is Heiko Rupp
> >> from the JON dev team (facts not obvious from the username), without
> >> having to go find an RHQ Admin and ask them. I can see hiding people's
> >> phone number and email address for privacy purposes. I'm up in the air
> >> about the two boolean fields.
> >>
> >> Users with MANAGE_SECURITY would of course be able to view and edit all
> >> details for all users, as they can today.
> >>
> >> Please let me know if you have an opinion on this, as I'd like to come
> >> up with a plan so I can implement it next week.
> >>
> >> Thanks,
> >> Ian
> >>
> >> _______________________________________________
> >> rhq-devel mailing list
> >> rhq-devel at lists.fedorahosted.org
> >> https://fedorahosted.org/mailman/listinfo/rhq-devel
> >
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 




More information about the rhq-devel mailing list