, I don't think I'm the right person to make that call. That said, inadvertently granting permission to create tags seems minor to me.
Digging in a little deeper, I can't actually find kb-ebsco.all defined in a back-end module. It's discussed in a ui-eholdings PR but the only place I actually see that pset being created is in an API test (). If it's truly only created by a test, then it still needs to be changed, but because it's a bogus value that may not be present outside our test env, not because it's a security risk.
Khalilah Gambrell June 14, 2021 at 7:01 PM
, should this be included in Iris Hotfix #2? Or is it okay to address in Juniper?
Summary:
module.eholdings.enabledis misleadingly named as a "Can view..." permission set but contains write-access to some modules: