A user can edit environment scoped variable

[srusinov-acr.org (Sergei Rusinov)]

I have 2018.3.8 version installed.
Prerequisites:

1. "Test project with tenanted deployment enabled
2. Two environments - “Env 1” and “Env1”
3. “Tenant 1” associated with the Project and and both environments
4. A variable defined in “Project Templates”
5. Two roles defined:
   4.1. “Test Editor with” “VariableEdit” and “TenantEdit” permissions granted
   4.2. “Test Reviewer” with “EnvironmentView”, “ProjectView”, “TenantView” and “VariableView” permissions granted.
6. Team “Test Editor” with Test Editor role assigned and scoped to the project, “Test” environment and “Tenant 1”.
7. Team “Test Reviewer” with VariableViewer role assigned and scoped to the project, both “Test” and “Prod” environments and “Tenant 1”.
8. A user assigned to both teams.

Steps to reproduce:

1. Login as the user
2. Go to the Tenant Variables page
3. Try editing the defined variable for “Prod” environment

Expected behavior: production environment variable cannot be changed or the change cannot be saved because the user has “VariableView” permission on for Prod environment.
Observer behavior: the variable can be changed and the change can be saved.

See the permissions exported csv file as well:

Permissions_export_2018_04_11__20_29_18_UTC.csv (325 Bytes)

I checked the release notes for the later releases - I could not find anything that looks like this issue.

[reece.walsh (Reece)]

Hi Sergei,

Thanks for getting in touch,

I’m sorry to hear you are experiencing this issue, I understand this behavior can be frustrating. I do, however, greatly appreciate your time in putting together these replication steps, this really helps out!

I’m currently looking into this and will get back to you ASAP with my findings and will link the associated Github issue here to keep track of the issue.

If you require any further assistance in the interim, please let me know

Kind Regards,

Reece

[reece.walsh (Reece)]

Hi Sergei,

Thanks for your patience,

As previously mentioned, I went away and was able to re-produce this behavior you are experiencing in Octopus version 2018.3.13 (latest) based on the information provided in your query, your clear explanation and steps are much appreciated!

I’ve included a link to the associated Github issue below;

Issue: Tenant Variables view-able/update-able for Environments not scoped in the associated Team when logged-in User is associated with Multiple Teams/User Roles

Please keep up to date with the progress of this issue at the aforementioned link.

I’m sorry this is causing an issue for you, If do you, however, require any further assistance in the interim, please don’t hesitate to reach out

Have a great day!

Kind Regards,

Reece

[srusinov-acr.org (Sergei Rusinov)]

Thanks, Reece.

I hope it’ll help you guys fix this issue as soon as possible. We are struggling with all kind of different permissions related issues that came with the versions released during past few months.