Bug #3454
closedAcknowledge all notices is presented to users who do not have privilege
100%
Description
I have local users that are just for OpenVPN authentication. They just have access to the System: User Password page, so they can change their password as needed. I was changing this for myself, and happened to get a system notice about AutoConfigBackup (not particularly relevant what the notice is). It gave me the "Acknowledge All Notices" prompt. When I clicked on it, the notices area on the top-right blanked out, but was not replaced by the usual bit with the name of the router, and some error message was displayed, of which I could see just the last line - "document.location.href = 'https://nco-rt-01.net.inf.org//system_usermanager_passwordmg.php';" - see the screen shot.
The notice does not get acknowledged, because I suppose the user does not have the privilege to acknowledge notices.
Possible solution: only present the "Acknowledge" button to users that have enough privilege to use it.
Also think about whether to even present the "Unread notices" at all to users with restricted privs. Certainly for users that have just the change password page, then I don't really want them to see system notices. But users with "view all" privs I do want to see system notices, but they may not be able to acknowledge them - what are the real requirements for that?
Files