[jira] [Commented] (ISIS-895) HomePage should honour authorization rules.

["ASF subversion and git services (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ISIS-895?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14134395#comment-14134395 ] 

ASF subversion and git services commented on ISIS-895:
------------------------------------------------------

Commit 5cd8afdd4a24451c1fecc3f8992bf450931eacf1 in isis's branch refs/heads/master from [~danhaywood]
[ https://git-wip-us.apache.org/repos/asf?p=isis.git;h=5cd8afd ]

ISIS-895: check that user has permissions to invoke home page action.

In addition:
- always render menu items, even on Error Page.


> HomePage should honour authorization rules.
> -------------------------------------------
>
>                 Key: ISIS-895
>                 URL: https://issues.apache.org/jira/browse/ISIS-895
>             Project: Isis
>          Issue Type: Improvement
>          Components: Core, Viewer: Wicket
>    Affects Versions: viewer-wicket-1.6.0, core-1.6.0
>            Reporter: Dan Haywood
>            Assignee: Dan Haywood
>            Priority: Minor
>             Fix For: viewer-wicket-1.7.0, core-1.7.0
>
>
> So, if a user doesn't have permission (the home page action isn't visible and/or usable) then it shouldn't be invoked, and instead simply show the welcome messages.
> However, this ticket does NOT require that the system checks that the user has permissions for the resultant object invoked from the home page action (a dashboard or whatever); rather the expectation is that the this the permissions be set-up correctly along with the user's permission to the home page action.
> If the user doesn't have permission to the resultant object, then the usual behaviour should occur, ie to show the error page.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)