Send command is restrected for standard user

Ihab2 years ago

Hello,
When I send a command to a device, owned by a standard user, I get this error:

Operation restricted - SecurityException (PermissionsService:95 < CommandResource:100 < ...)

but it works when I send it using the admin account.
Any suggestions?

P.D I'm using the latest tracker manager and the latest server.
Thank you

Ihab2 years ago

This is the endpoint that is being used:

endpoint={`/api/commands/send?deviceId=${deviceId}`}: CommandSendPage.js Line 98
Anton Tananaev2 years ago

Looks like your user has commands restricted.

Ihab2 years ago

How can I change this restriction?

Anton Tananaev2 years ago

You can remove it in the same place where you've added it. It's either user or server settings.

Ihab2 years ago

Ok so the limit command option is to prevent users from sending commands.
However there is a fix here: https://github.com/traccar/traccar-web/commit/1beb6c174a0622126d704ecc2dd26a8d1b70460d
Which uses limit command to limit showing only the selected commands for a user.
These are two different concepts.

Anton Tananaev2 years ago

Are you sending one of those? Have you compiled and deployed an updated backend?

Ihab2 years ago

For now, following the fix in the previous commit, I made these changes:

+import { useAdministrator } from '../common/util/permissions';
...
-const limitCommands = useRestriction('limitCommands');
+const limitCommands = !useAdministrator();

this way I force the standard users to have available only the pre-selected commands.
The admin, on the other hand, will have all commands.

Thanks for your help

Anton Tananaev2 years ago

This is in the web app. I asked about the backend.

Ihab2 years ago

No, I did not touch the backend.

Anton Tananaev2 years ago

The error is coming from the backend. You need to fix the backend as well.