Admin only access for Logbook and History menus

winnerNick · April 17, 2020, 6:28pm

Currently (version 0.108.6) logbook and history are displayed to all users.

Although you can create a dashboard for a “guest” or “tablet” user (in order to control certain areas), the access to logbook and history give them also access to all devices!

This a feature request but a security issue also!
It would be nice to have permissions for these menus.

seblu · September 26, 2020, 12:29pm

Hello,

I’m also interested by this question. Could we limit access to logbook and journal to non admin users ?

Regards,

Miguel_Alvarez · October 26, 2020, 2:53pm

I also think options like history, logbook, should be hidden from users. Or at least admins should have the ability to enable or disable them for each user

WindowHero · October 30, 2020, 3:06am

I also think this feature would be important.

brandont · November 23, 2020, 3:55pm

Adding my plea for this functionality

DDomnick · January 6, 2021, 11:24am

+1 Please!

paolomorabito · January 11, 2021, 3:02pm

Yes, I’m interested too

nick2525 · January 11, 2021, 5:48pm

It will be nice to have user roles. Sometimes user need only readonly, and not allowed to turn on/turn off

Martidjen · February 7, 2021, 9:40pm

And another +1

homeassistantGouveia · March 14, 2021, 7:29pm

The only way i found was to remove “default_config” from configuration.yaml.
But it removes from admin users too

CentralCommand · March 14, 2021, 8:20pm

I’m going to +1 this because I want the ability to hide these options from people who don’t need to see them. But I don’t really agree with the security issue portion. If your goal is operate HA in some kind of multi-tenant environment where data can be fully segregated and users can only see their own data then you need to make a separate feature request for that. And boy will that be a lot of work.

Just in case people are unaware, it really doesn’t matter whether these tabs show up or not from a security perspective. All these tabs do is make calls into the REST API. Anyone with a login can do that, they don’t need a UI. The API allows anyone with a login on your system to get any state, call any service, create any state, etc. etc.

So yea, hiding these tabs is irrelevant to security. That’s a form of security by obscurity at best (except not really because the APIs are pretty well documented).

Cynster · March 25, 2021, 5:51pm

I would love to get more (access) control over the menu

tykeal · April 2, 2021, 1:23pm

It may be a security through obscurity thing, but it’s movement towards a more secure configuration.

nostra · June 22, 2021, 6:52pm

+1 from me as well.

peregrines · August 22, 2021, 1:48pm

+1
Would really looking forward too be able to hide these things!

xMariusz · November 5, 2021, 1:18pm

Any update? Is way to set only admin access for logbook and history menu?

nick2525 · November 6, 2021, 4:30pm

It will be nice to have temporary login at some user with admin rights, when setup user account (turn off some buttons) and when remove admin rights for user.

lucidnx · November 17, 2021, 10:04pm

+1 here! I would like to see ability to show/hide menu items per user!

pkleingu · December 10, 2021, 2:20pm

History, Log, Map, energy, is only for admins.
And for CAT casting is would be nice a password free acces account only to a lovelace webpage on local netwerk.

duittenb · January 4, 2022, 11:04am

Agree. It may not matter from a security perspective but I like to clean up the GUI as much as possible for my wife, my kids, the baby sitter, family or guests staying here.
If it’s not relevant to users or if they don’t need it, they shouldn’t see it.