MasterVitronic / fusionpbx

Automatically exported from code.google.com/p/fusionpbx
0 stars 0 forks source link

Admin User can Delete Super Admin User #445

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1.Create a new user in usermanager and add him to admin group
2.Login as the new admin user
3.Admin user can now delete SuperAdmin User

What is the expected output? What do you see instead?
The Admin user should not be able to delete SuperAdmin users or not be able to 
see them at all might be a better option.

What version of the product are you using? On what operating system?
FusionPBX 3.3-1
pool/main/f/fusionpbx-dev/fusionpbx-dev_3.3-1_all.deb
Debian 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux

Please provide any additional information below.

Original issue reported on code.google.com by ibslk...@gmail.com on 5 Aug 2013 at 6:29

GoogleCodeExporter commented 9 years ago
Thanks for reporting this problem. To clarify the user in the superadmin group 
would have to be in the same tenant/domain as the user in the admin group.

This has been fixed in both the stable and dev branch. Superadmin users are 
hidden from users that are not in the superadmin group. Also correctly fixed 
code that now correctly provides access denied to the edit page for users that 
are not superadmins trying to edit a superadmin account.

Original comment by markjcrane@gmail.com on 16 Aug 2013 at 7:00