fix(security): block user access policies for non admins EE-5826 (#10243)

2023-09-05 09:17:55 +12:00
parent 6a08bbe7e9
commit d75a8027a5
1 changed files with 1 additions and 0 deletions
--- a/api/http/security/filter.go
+++ b/api/http/security/filter.go
@@ -100,6 +100,7 @@ func FilterEndpoints(endpoints []portainer.Endpoint, groups []portainer.Endpoint
 		endpointGroup := getAssociatedGroup(&endpoint, groups)

 		if AuthorizedEndpointAccess(&endpoint, endpointGroup, context.UserID, context.UserMemberships) {
+			endpoint.UserAccessPolicies = nil
 			endpoints[n] = endpoint
 			n++
 		}