Can Add "fts" Permission through API
hammy275 opened this issue · comments
Users with the permission to manage_users can use the API to add the fts permission, allowing those with the permission to change the port, domain, and CORS usage!
Keeping this open but removing the security label, as the actual first time setup will bail if first time setup was already performed. This means that although the user can get the "fts" permission, it's effectively useless, as unless a sysadmin were to manually change the database to remove the fact that first time setup was complete, the "fts" permission wouldn't allow anything to occur.