inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2026-07-05 06:32:55 +00:00
Code Activity

docs: add more details around staff / superuser roles and their dangers (#11658)

Browse Source
This commit is contained in:
Matthias Mair
2026-04-02 01:40:10 +02:00
committed by GitHub
parent c8bcb924ca
commit a8cef43484
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/concepts/threat_model.md
+1 -1
View File
@@ -16,7 +16,7 @@ Deploying InvenTree to production requires to knowledge of the security assumpti
2. All users are trusted - therefore user uploaded files can be assumed to be safe. There are basic checks in place to ensure that the files are not using common attack vectors but those are not exhaustive.
3. Superuser permissions are only given to trusted users and not used for daily operations. A superuser account can manipulate or extract all files on the server that the InvenTree server process have access to.
3. Superuser or staff permissions are only given to trusted users and not used for daily operations. A superuser account can manipulate or extract all files on the server that the InvenTree server process have access to. See [dangerous user flags](../settings/permissions.md#dangerous-user-flags) for more details on user permissions and flags.
4. All templates and plugins are trusted.