Any user can save changes to a layer's existing style(s)

[dwins]

Any user can edit and save changes to a layer's style(s). This can lead to unwanted changes in the maps of other users that display the layer. Maybe the ability to edit layer styles should be limited to users who have read/write or admin permission for the layer itself.

[mbertrand]

Wrote some preliminary code for Worldmap to prevent the 'Styles' tab from appearing in the Layer Properties window unless the user has edit permission for the layer:

cga-harvard@43a3772

cga-harvard/geonode-client@39e8287#L0L986

[sbenthall]

This requires either a deep change in GeoServer to allow more granular permissions on configuration, or a shallower change to handle these permissions in the Django app.

Need to see if GeoServer development on this is feasible (organizationally).

The Django app is the wrong place for this.

[ingenieroariel]

Actually now that I think about it we could do this on the Django side - since we don't have the ability to grant users admin privileges on a subset of GeoServer's configured layers, ALL admin requests are made by having the Django app proxy the request. We could just make the Django app a little smarter about figuring out what styles can be edited by a particular user.

(btw earlier comment was that the Django app was the wrong place to store styles, not necessarily that it was a bad place to apply security restrictions)

[sbenthall]

It's not clear where to implement this. Ideally it would be in the GeoServer configuration... waiting for some sort of confirmation on that from a core GeoServer dev.

[ahocevar]

#983 is a duplicate of this issue and has some more discussion.

[simod]

Is this a real 2.0 bug?
We think we could move this to the 2.1 for now as the styles can be changed by registered users.
A good solution couldbe the one proposed by Ariel, the permissions can be defined them on the layers.models.style model.

[capooti]

+1 to define the permissions in the layers.models.style model.
Any chance this could be implemented for 2.0?
thanks

[ischneider]

For a version 1 cut at this (to get it into 2.0), the permissions could be implicit - if the user can modify the layer, they can modify the style. The client still needs work and the proxy view would also need to enforce this rule.

[ingenieroariel]

This should be addressed as part of the Permissions GNIP : #255

[ingenieroariel]

If someone wants to write unit tests demonstrating the failure be our guest :)

[tjk1]

Any updates on this issue? The preservation of default styles would be really helpful.

[capooti]

@tjk1k this is another issue, and is fixed. If you have some kind of problems with preservation of default styles (I am not sure what kind of problem, need more details), please file another ticket.

[tjk1]

@capooti Same issue, I believe. I was considering any style created by the 'owner' of a layer to be the default style (for all users) and would like to keep others from changing (breaking) it.

[capooti]

but this is working now, the test is there to prove it. In case you don't want an user to edit a style just remove from him the change_layer_style permission. Are you talking of master, correct?

[tjk1]

@capooti also, which version is this issue fixed on?

[capooti]

it is on master, the change_layer_style permission is not available in
GeoNode 2.0.
Therefore you will be able to use with next GeoNode 2.4 (of using the trunk)

On Tue, Dec 2, 2014 at 3:04 PM, tjk1 [email protected] wrote:

@capooti https://github.com/capooti also, which version is this issue
fixed on?

—
Reply to this email directly or view it on GitHub
#134 (comment).

Paolo Corti
Geospatial software developer
web: http://www.paolocorti.net
twitter: @capooti
skype: capooti

[tjk1]

Excellent, thanks for the help

[jj0hns0n]

Can we close this now?

[capooti]

yes. please do it
On Jan 12, 2015 9:02 PM, "Jeffrey Johnson" [email protected] wrote:

Can we close this now?

—
Reply to this email directly or view it on GitHub
#134 (comment).