Docker swarm service update webhooks accessible only by admin

[lafriks]

Bug description

With PR #7239 docker swarm service webhooks can be enabled and seen only by admin users.

Expected behavior

This is breaking change and should probably changed back (as personally I don't see reason why user can do this manually but can not create webhook for that).

Steps to reproduce the issue:

1. Go to 'Service' with user who deployed stack
2. No option to create webhook

Technical details:

• Portainer version: 2.15.1
• Have you reviewed our technical documentation and knowledge base? Yes

[lafriks]

Exact change that changes behavior:

https://github.com/portainer/portainer/pull/7239/files#diff-a48a3a383b813ad5f6c8741080e0956361ee97740118810c3a898949b3780056L70-R76

[tamarahenson]

@lafriks

The change was made to make Portainer more secure from malicious users. The Role allowed to Edit is the Environment Administrator.

Thanks!

[lafriks]

So that means that standard user with limited set of resources he has assigned and who can create/update/delete stacks manually can not uses webhooks anymore. And only way to allow them to use webhooks is to assign them environment administrator that will be able to see all resources?

[tamarahenson]

@lafriks

Standard Users can create Stacks and enable webhooks. The Environment Administrators can toggle the webhook after creation. If you want a user to edit a webhook, they have to be in the Environment Administrator role.

Thanks!

[lafriks]

My scenario is that standard user creates stack but he has no option to create or see webhook url for that stack services.

[lafriks]

@tamarahenson from your reply I understand that standard user should be able to create webhook for his created stack services, right?

[tamarahenson]

@lafriks

I performed the following testing:

Docker Standalone:
[1] User: thenson >> Standard User
[2] Create Stack >> Toggle Webhook

Docker Swarm
[1] User:thenson >> Standard User
[2] Create Service >> Toggle Webhook

Can you attach screenshots or vids showing your issue?

Thanks!

[lafriks]

Here is how we use it:

Docker Swarm
[1] User: test >> Standard User
[2] Create Stack
[3] Go to stack service
[4] Create webhook for service (not possible with latest version)

[tamarahenson]

@lafriks

Thank you for the additional information. I see here you are in CE and I was testing in BE hence the confusion. I am going to further investigate. I will update you as I learn more.

Thanks!

[lafriks]

@tamarahenson it's just demo instance I did set up but shouldn't standard user rights behave same on both CE and BE?

[lafriks]

@tamarahenson any update on this?

[lafriks]

any update of this, maybe I can create PR to fix this if some hint could be provided on how to better do this?

[lafriks]

as issue was converted to discussion does that mean it will not be fixed? Would it be ok if I send PR to fix this?

[lafriks]

@jamescarppe can you comment on this as there is no answer to this for quite some time 😕

[jamescarppe]

It looks like this one might have slipped through the cracks at some point - sorry about that. I'll check with the wider team as to where this is and get back to you as soon as I know more.