New Features 2017Project Type: software

New Features 2017

Uploaded image for project: 'New Features 2017'
  1. New Features 2017
  2. NF-2965

[Security]-[Authorization Failure]-[Azure] Employee can access all Admin pages over the URL and able to update the customization/settings for those pages.

    Details

    • Type: Bug
    • Status: Closed
    • Priority: High
    • Resolution: Bug Fixed
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: UI Refresh
    • Labels:
      None
    • Environment:
      Others
    • Bug Type:
      Functional
    • Bug Severity:
      Medium
    • Level:
      Admin
    • Module:
      Platform
    • Reported by:
      Harbinger
    • Company:
      All Clients/Multiple Clients
    • Item State:
      LB QA - In Testing
    • Issue Importance:
      Q2

      Description

      [Security]-[Authorization Failure] Employee can access all Admin pages over the URL and able to update the customization/settings for those pages.

      Environment : Azure
      Replication Steps:
      1. Login as Company Admin
      2. GO to Company Information Page.
      3. Copy the URL
      4. Login with Employee of same company in another browser.
      5. Paste the URL in employee's session.
      6. Access the Admin pages and try to update settings.

      Observed Same behavior on multiple pages like All tabs in Company Information, Manage Admin Users, Security Page, Site Branding and Themes etc.
      It seems that this issue is with all pages and necessary access level entries are missing.

      Expected Result:

      As soon as any admin level page URL is accessed by Employee Login it should show the Unauthorized Access page and restrict user for further actions.

      CC : Rakesh RoySachin HingoleHrishikesh DeshpandeVijay SiddhaVijayendra ShindeRohan J KhandaveBharti SatputeSamir

        Attachments

        1. AdminLogin.jpg
          AdminLogin.jpg
          162 kB
        2. Empl__CAPagesAdminUsers.jpg
          Empl__CAPagesAdminUsers.jpg
          124 kB
        3. Empl_Access_CAPagesCompInfo.jpg
          Empl_Access_CAPagesCompInfo.jpg
          135 kB
        4. EmployeeLoign.jpg
          EmployeeLoign.jpg
          148 kB
        5. PageLevelAccess.png
          PageLevelAccess.png
          139 kB

          Issue Links

          relates to

          Task - A task that needs to be done. NF-2714 Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.

          • Medium - Has the potential to affect progress.
          • To Do

            Activity

            Ascending order - Click to sort in descending order
            9 older comments
            Hide
            Permalink
            khandu.kshirsagar Khandu Kshirsagar (Inactive) added a comment -

            Hi Ashwin Wankhede,

            Done.

            Ashwin Wankhede

            Show
            khandu.kshirsagar Khandu Kshirsagar (Inactive) added a comment - Hi Ashwin Wankhede , Done. Ashwin Wankhede
            Hide
            Permalink
            anirudha.joshi anirudha joshi (Inactive) added a comment - - edited

            Hi Ashwin Wankhede Vijayendra Shinde

            I verified this issue with PagelevelAccess flag set to True. The issue still persists
            Below are the steps executed and the observations.

            Repro Steps:

            • Login with partner credentials
            • Navigate to 'UI Refresh Automation' company.
            • Change any employee password
            • Login with this employee in other browser
            • Copy the link ‘Change employee Status’ from partner login to the browser where same employee is logged in
            • Employee is able to change the class/status.

            Observations:
            Eemployee is able to access the 'Change Status' page from partner login.
            Employee is able to access 'BenAdmin -> Pending Queue' page from partner login.

            I verified different pages from BenAdmin, Onboard, Core HR tabs of partner login. Above 2 pages were accessible to the employee even after the 'PageLevelAccess' was set to 'True'.

            Regards,
            Anirudha Joshi

            CC: Prasad Pise Nidhi Kaul Bharti Satpute Samir Rakesh Roy

            Show
            anirudha.joshi anirudha joshi (Inactive) added a comment - - edited Hi Ashwin Wankhede Vijayendra Shinde I verified this issue with PagelevelAccess flag set to True. The issue still persists Below are the steps executed and the observations. Repro Steps: Login with partner credentials Navigate to 'UI Refresh Automation' company. Change any employee password Login with this employee in other browser Copy the link ‘Change employee Status’ from partner login to the browser where same employee is logged in Employee is able to change the class/status. Observations: Eemployee is able to access the 'Change Status' page from partner login. Employee is able to access 'BenAdmin -> Pending Queue' page from partner login. I verified different pages from BenAdmin, Onboard, Core HR tabs of partner login. Above 2 pages were accessible to the employee even after the 'PageLevelAccess' was set to 'True'. Regards, Anirudha Joshi CC: Prasad Pise Nidhi Kaul Bharti Satpute Samir Rakesh Roy
            Hide
            Permalink
            vishal.yadav Vishal Yadav (Inactive) added a comment - - edited

            Hi Ashwin Wankhede,

            I have checked this issue and found that it is working on local (development) environment. But not working on codemap.
            Need to check web.config on codemap machine.

            Thanks,
            Vishal Y

            CC : Vijayendra Shinde

            Show
            vishal.yadav Vishal Yadav (Inactive) added a comment - - edited Hi Ashwin Wankhede , I have checked this issue and found that it is working on local (development) environment. But not working on codemap. Need to check web.config on codemap machine. Thanks, Vishal Y CC : Vijayendra Shinde
            Hide
            Permalink
            vishal.yadav Vishal Yadav (Inactive) added a comment -

            affected files :

            /branches/UiRefresh/Config Files WT Stage/Web Server/Web.config

            Show
            vishal.yadav Vishal Yadav (Inactive) added a comment - affected files : /branches/UiRefresh/Config Files WT Stage/Web Server/Web.config
            Hide
            Permalink
            vishal.yadav Vishal Yadav (Inactive) added a comment -

            Hi Prasad Pise,

            Please check this issue after next azure build.

            Thanks,
            Vishal Y

            Show
            vishal.yadav Vishal Yadav (Inactive) added a comment - Hi Prasad Pise , Please check this issue after next azure build. Thanks, Vishal Y

              People

              Assignee:
              prasadp Prasad Pise (Inactive)
              Reporter:
              prasadp Prasad Pise (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 4h Original Estimate - 4h
                  4h
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 9.5h
                  9.5h